PT-2019-8793 · Puppet · Puppet Agent

Published 2019-12-16 · Updated 2020-04-07 · CVE-2018-11751

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Puppet Agent versions prior to 6.4.0

Description The issue arises from the lack of peer verification in the SSL connection before downloading the CRL.

Recommendations For versions prior to 6.4.0, update to version 6.4.0 to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2018-11751

RHSA-2020:4366

Affected Products

Puppet Agent

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-11751 · Security Note
• https://puppet.com/security/cve/CVE-2018-11751 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11751 · Vendor Advisory