PT-2019-8792 · Puppet+1 · Puppet Discovery+1

Yanshuchong · Publicado 2019-03-17 · Atualizado 2020-12-16 · CVE-2018-11747

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puppet Discovery versions prior to 1.4.0

Description The issue concerns a default generated TLS certificate in the nginx container. Previously, Puppet Discovery was shipped with this default certificate. In version 1.4.0, a unique certificate will be generated on installation, or the user will be able to provide their own TLS certificate for ingress.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 to generate a unique TLS certificate on installation or provide your own TLS certificate for ingress.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2018-11747

Produtos afetados

Puppet Discovery

Nginx

Referências · 5

• https://t.me/cvenotify/7140 · Publicação no Telegram
• https://puppet.com/security/cve/CVE-2018-11747 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-11747 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11747 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Nota