Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:1057-1

Опубликовано: 21 апр. 2020
Источник: suse-cvrf

Описание

Security update for puppet

This update for puppet fixes the following issues:

  • CVE-2020-7942: Added a warning for a vulnerable configuration option, which could allow for information disclosure in certain setups. Disabling it my break some setups. (bsc#1167645)

Список пакетов

SUSE Linux Enterprise Module for Advanced Systems Management 12
puppet-3.8.5-15.12.1
puppet-server-3.8.5-15.12.1

Ссылки

Описание

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

Затронутые продукты
SUSE Linux Enterprise Module for Advanced Systems Management 12:puppet-3.8.5-15.12.1
SUSE Linux Enterprise Module for Advanced Systems Management 12:puppet-server-3.8.5-15.12.1
Ссылки