Improper Certificate Validation Affecting puppet package, versions >=6.0.0, <6.4.0
Threat Intelligence
EPSS
0.06% (27th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUPPET-537892
- published 17 Dec 2019
- disclosed 16 Dec 2019
- credit Unknown
Introduced: 16 Dec 2019
CVE-2018-11751 Open this link in a new tabHow to fix?
Upgrade puppet to version 6.4.0 or higher.
Overview
puppet is an automated configuration management tool.
Affected versions of this package are vulnerable to Improper Certificate Validation. It does not verify the peer in the SSL connection prior to downloading the CRL.
CVSS Scores
version 3.1