Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2020-7942

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to every

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
puppet

Description

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Puppet Puppet

  • 5.5.x prior to 5.5.19affected
  • Fixed in 5.5.19affected
  • 6.x prior to 6.13.0affected
  • Fixed in 6.13.0affected

Puppet Puppet Agent

  • 5.5.x prior to 5.5.19affected
  • Fixed in 5.5.19affected
  • 6.x prior to 6.13.0affected
  • Fixed in 6.13.0affected

References