CoreCVE
Back

MEDIUM

puppet: Arbitrary catalog retrieval

Published Feb 19, 2020

Description

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

Affected products

Remediation

Red Hat statement

In Red Hat OpenStack Platform, Puppet is invoked as a standalone component (puppet master is not run). This means that although the vulnerable code might be present, it is not used, resulting in a lowered impact rating and no update will be provided at this time.

Red Hat mitigation

In the puppet.conf configuration file set `strict_hostname_checking = true`.

Weaknesses (2)

CWE-295

Improper Certificate Validation

CWE-297

References (8)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner puppet
Published Feb 19, 2020
Updated Aug 4, 2024
Reserved Jan 23, 2020
Link CVE-2020-7942

CISA Vulnrichment

No data

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2020-7942

Red Hat

Severity Moderate
Public date Feb 18, 2020
Bugzilla 1816720
Link CVE-2020-7942

ENISA EUVD

Assigner puppet
Published Feb 19, 2020
Updated Aug 4, 2024
Link EUVD-2021-0827

GitHub

Link GHSA-GQVF-892R-VJM5