PT-2023-17321 · Puppet+1 · Puppet Server+1

Publicado 2023-05-04 · Atualizado 2023-05-11 · CVE-2023-1894

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Puppet Server version 7.9.2

Description A Regular Expression Denial of Service (ReDoS) issue was discovered in the certificate validation of Puppet Server. This issue is related to specifically crafted certificate names, which can significantly slow down server operations.

Recommendations For Puppet Server version 7.9.2, consider restricting the use of certificate validation until a patch is available. As a temporary workaround, review and filter certificate names to prevent specifically crafted names from causing a denial of service.

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

CVE-2023-1894

RHSA-2023:6818

RLSA-2023:6818

Produtos afetados

Puppet Server

Rocky Linux

Referências · 13

• https://github.com/puppetlabs/puppetserver/pull/2700 · Nota
• https://github.com/puppetlabs/puppetserver/commit/9e0239c19bc852b98c1a63fb33998de7eae388dc · Nota
• https://github.com/puppetlabs/puppetserver/commit/545998b71baf70e35dc60c287f2cb2fc11ef9be2 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1894 · Aviso do Fabricante
• https://puppet.com/security/cve/cve-2023-1894-puppet-server-redos · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-1894 · Aviso do Fabricante
• https://errata.rockylinux.org/RLSA-2023:6818 · Aviso do Fabricante
• https://t.me/cibsecurity/63343 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-1894 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-1894 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-1894 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1894 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-1894 · Nota de Segurança