PT-2019-8792 · Puppet+1 · Puppet Discovery+1

Yanshuchong · Published 2019-03-17 · Updated 2020-12-16 · CVE-2018-11747

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Puppet Discovery versions prior to 1.4.0

Description The issue concerns a default generated TLS certificate in the nginx container. Previously, Puppet Discovery was shipped with this default certificate. In version 1.4.0, a unique certificate will be generated on installation, or the user will be able to provide their own TLS certificate for ingress.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 to generate a unique TLS certificate on installation or provide your own TLS certificate for ingress.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-11747

Affected Products

Puppet Discovery

Nginx

References · 5

• https://puppet.com/security/cve/CVE-2018-11747 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11747 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11747 · Vendor Advisory
• https://t.me/cvenotify/7140 · Telegram Post
• https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E · Note