CVE-2018-11751

Published: 16 December 2019

Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.

From the Ubuntu Security Team

msalvatore> Affects 6.x prior to 6.4.0

Priority

Cvss 3 Severity Score

5.4

Score breakdown

Status

Package	Release	Status
puppet Launchpad, Ubuntu, Debian	bionic	Not vulnerable (code not present)
	disco	Ignored (end of life)
	eoan	Not vulnerable (code not present)
	trusty	Not vulnerable (code not present)
	upstream	Released (6.4.0)
	xenial	Not vulnerable (code not present)

Severity score breakdown

Parameter	Value
Base score	5.4
Attack vector	Adjacent
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›