PT-2020-19865 · Puppet · Continuous Delivery For Puppet Enterprise

Published 2020-09-18 · Updated 2020-09-30 · CVE-2020-7945

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Continuous Delivery for Puppet Enterprise versions prior to 4.0.1

Description The issue concerns the exposure of local registry credentials to unauthorized users due to their inclusion in the CD4PE deployment definition.

Recommendations For versions prior to 4.0.1, update to version 4.0.1 to resolve the issue.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2020-7945

Affected Products

Continuous Delivery For Puppet Enterprise

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-7945 · Security Note
• https://puppet.com/security/cve/CVE-2020-7945 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7945 · Vendor Advisory