GHSA-gqvf-892r-vjm5

Suggest an improvement
Source
https://github.com/advisories/GHSA-gqvf-892r-vjm5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-gqvf-892r-vjm5/GHSA-gqvf-892r-vjm5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gqvf-892r-vjm5
Aliases
Published
2021-04-13T15:42:19Z
Modified
2024-02-22T05:39:45Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Improper Certificate Validation in Puppet
Details

Previously, Puppet operated on the model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the default node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting strict_hostname_checking = true in puppet.conf on your Puppet master. Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.

Database specific 
{
    "cwe_ids":  [
        "CWE-295"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-04-07T23:15:22Z",
    "nvd_published_at":  "2020-02-19T21:15:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0
Fixed
6.13.0

Affected versions

6.*
6.0.0
6.0.1
6.0.2
6.0.3
6.0.4
6.0.5
6.0.7
6.0.8
6.0.9
6.0.10
6.1.0
6.2.0
6.3.0
6.4.0
6.4.1
6.4.2
6.4.3
6.4.4
6.4.5
6.5.0
6.6.0
6.7.0
6.7.2
6.8.0
6.8.1
6.9.0
6.10.0
6.10.1
6.11.0
6.11.1
6.12.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-gqvf-892r-vjm5/GHSA-gqvf-892r-vjm5.json"

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.5.19

Affected versions

0.*
0.9.2
0.13.0
0.13.1
0.13.2
0.13.6
0.16.0
0.18.4
0.22.4
0.23.0
0.23.1
0.23.2
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.24.6
0.24.7
0.24.8
0.24.9
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
2.*
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.10
2.6.11
2.6.12
2.6.13
2.6.14
2.6.15
2.6.16
2.6.17
2.6.18
2.7.1
2.7.3
2.7.4
2.7.5
2.7.6
2.7.8
2.7.9
2.7.11
2.7.12
2.7.13
2.7.14
2.7.16
2.7.17
2.7.18
2.7.19
2.7.20.rc1
2.7.20
2.7.21
2.7.22
2.7.23
2.7.24
2.7.25
2.7.26
3.*
3.0.0.rc4
3.0.0.rc5
3.0.0.rc7
3.0.0.rc8
3.0.0
3.0.1.rc1
3.0.1
3.0.2.rc1
3.0.2.rc2
3.0.2.rc3
3.0.2
3.1.0.rc1
3.1.0.rc2
3.1.0
3.1.1
3.2.0.rc1
3.2.0.rc2
3.2.1.rc1
3.2.1
3.2.2
3.2.3.rc1
3.2.3
3.2.4
3.3.0.rc2
3.3.0.rc3
3.3.0
3.3.1.rc1
3.3.1.rc2
3.3.1.rc3
3.3.1
3.3.2
3.4.0.rc1
3.4.0.rc2
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0.rc1
3.5.0.rc2
3.5.0.rc3
3.5.1.rc1
3.5.1
3.6.0.rc1
3.6.0
3.6.1
3.6.2
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
4.*
4.0.0.rc1
4.0.0
4.1.0
4.2.0
4.2.1
4.2.2
4.2.3
4.3.0
4.3.1
4.3.2
4.4.0
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
4.5.3
4.6.1
4.6.2
4.7.0
4.7.1
4.8.0
4.8.1
4.8.2
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.10.0
4.10.1
4.10.4
4.10.5
4.10.6
4.10.7
4.10.8
4.10.9
4.10.10
4.10.11
4.10.12
5.*
5.0.0
5.0.1
5.1.0
5.2.0
5.3.1
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.4.0
5.5.0
5.5.1
5.5.2
5.5.3
5.5.6
5.5.7
5.5.8
5.5.10
5.5.12
5.5.13
5.5.14
5.5.16
5.5.17
5.5.18

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-gqvf-892r-vjm5/GHSA-gqvf-892r-vjm5.json"