PT-2023-17321 · Puppet+1 · Puppet Server+1

Published 2023-05-04 · Updated 2023-05-11 · CVE-2023-1894

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Puppet Server version 7.9.2

Description A Regular Expression Denial of Service (ReDoS) issue was discovered in the certificate validation of Puppet Server. This issue is related to specifically crafted certificate names, which can significantly slow down server operations.

Recommendations For Puppet Server version 7.9.2, consider restricting the use of certificate validation until a patch is available. As a temporary workaround, review and filter certificate names to prevent specifically crafted names from causing a denial of service.

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2023-1894

RHSA-2023:6818

RLSA-2023:6818

Affected Products

Puppet Server

Rocky Linux

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1894 · Vendor Advisory
• https://puppet.com/security/cve/cve-2023-1894-puppet-server-redos · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-1894 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2023:6818 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1894 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1894 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1894 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1894 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1894 · Security Note
• https://github.com/puppetlabs/puppetserver/pull/2700 · Note
• https://github.com/puppetlabs/puppetserver/commit/9e0239c19bc852b98c1a63fb33998de7eae388dc · Note
• https://github.com/puppetlabs/puppetserver/commit/545998b71baf70e35dc60c287f2cb2fc11ef9be2 · Note
• https://t.me/cibsecurity/63343 · Telegram Post