Information Exposure Affecting puppet package, versions <3.6.2
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUPPET-20330
- published 28 Feb 2017
- disclosed 10 Jun 2014
- credit Puppet Labs
Introduced: 10 Jun 2014
CVE-2014-3250 Open this link in a new tabHow to fix?
Upgrade puppet to version 3.6.2 or higher.
Overview
puppet is an automated configuration management tool.
Affected versions of the package are vulnerable to Information Leakage.
In Apache 2.4, SSLCARevocationCheck directive was added to mod_ssl, which defaults it to none and must be explicitly configured. This setting enables checking of a certificate revocation list. The default Puppet master vhost config shipped with Puppet does not include this setting. If a Puppet master is set up to run with Apache 2.4, and this default vhost configuration file is used, the Puppet master will continue to honor a host's certificate even after it is revoked.