Описание
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
A flaw was found in Puppet, where the Puppet Agent did not verify the peer in the SSL connection before downloading to the Certificate Revocation List (CRL). The primary risk is the availability of communications to computing systems and not Puppet itself. This flaw allows an attacker to submit a phony CRL, potentially denying future automation of systems driven by Puppet.
Отчет
Red Hat Update Infrastructure 3 is in Maintenance Support phase and product only fixing Critical or Important impact flaws. Please refer lifecycle page for more details: https://access.redhat.com/support/policy/updates/rhui
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenStack Platform 10 (Newton) | puppet | Out of support scope | ||
| Red Hat OpenStack Platform 13 (Queens) | puppet | Not affected | ||
| Red Hat OpenStack Platform 15 (Stein) | puppet | Not affected | ||
| Red Hat OpenStack Platform 16 (Train) | puppet | Not affected | ||
| Red Hat Update Infrastructure 3 for Cloud Providers | puppet | Will not fix | ||
| Red Hat Satellite 6.8 for RHEL 7 | ansible-collection-redhat-satellite | Fixed | RHSA-2020:4366 | 27.10.2020 |
| Red Hat Satellite 6.8 for RHEL 7 | ansiblerole-foreman_scap_client | Fixed | RHSA-2020:4366 | 27.10.2020 |
| Red Hat Satellite 6.8 for RHEL 7 | ansiblerole-insights-client | Fixed | RHSA-2020:4366 | 27.10.2020 |
| Red Hat Satellite 6.8 for RHEL 7 | ansiblerole-satellite-receptor-installer | Fixed | RHSA-2020:4366 | 27.10.2020 |
| Red Hat Satellite 6.8 for RHEL 7 | ansible-runner | Fixed | RHSA-2020:4366 | 27.10.2020 |
Показывать по
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
Previous versions of Puppet Agent didn't verify the peer in the SSL co ...
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
EPSS
3.7 Low
CVSS3