5.4med
CVE-2018-11751
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL.
Published 6 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known
Summary
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
Exploit prediction (EPSS)
0.61% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
| NVD | 2.0 | 4.8 | AV:A/AC:L/Au:N/C:N/I:P/A:P |
Affected products
- n/a Puppet Agent, Puppet
Classification
- Weakness
- CWE-295 Improper Certificate Validation
References
- puppet.com /security/cve/CVE-2018-11751 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-11751
- NVD: CVE-2018-11751
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.