CVE-2017-2299 Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the ssl_ca parameter but do not specify the ssl_certs_dir pa...
HighCVSS 7.5
EPSS 0.85%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the ssl_ca parameter but do not specify the ssl_certs_dir parameter, a default will be provided for the ssl_certs_dir that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/puppet-module-puppetlabs-apache(Debian:12) | < 3.0.0-1 | 3.0.0-1 |
| debian/puppet-module-puppetlabs-apache(Debian:13) | < 3.0.0-1 | 3.0.0-1 |
| puppetlabs-apache | = 0.0.4 | No fix listed |
| puppetlabs-apache | = 0.4.0 | No fix listed |
| puppetlabs-apache | = 0.6.0 | No fix listed |
| puppetlabs-apache | = 0.7.0 | No fix listed |
| puppetlabs-apache | = 0.8.0 | No fix listed |
| puppetlabs-apache | = 0.8.1 | No fix listed |
| puppetlabs-apache | = 0.9.0 | No fix listed |
| puppetlabs-apache | = 0.10.0 | No fix listed |
| puppetlabs-apache | = 0.11.0 | No fix listed |
| puppetlabs-apache | = 1.0.0 | No fix listed |
| puppetlabs-apache | = 1.0.1 | No fix listed |
| puppetlabs-apache | = 1.1.0 | No fix listed |
| puppetlabs-apache | = 1.1.1 | No fix listed |
| puppetlabs-apache | = 1.2.0 | No fix listed |
| puppetlabs-apache | = 1.3.0 | No fix listed |
| puppetlabs-apache | = 1.4.0 | No fix listed |
| puppetlabs-apache | = 1.4.1 | No fix listed |
| puppetlabs-apache | = 1.5.0 | No fix listed |
| puppetlabs-apache | = 1.6.0 | No fix listed |
| puppetlabs-apache | = 1.7.0 | No fix listed |
| puppetlabs-apache | = 1.7.1 | No fix listed |
| puppetlabs-apache | = 1.8.0 | No fix listed |
| puppetlabs-apache | = 1.8.1 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| puppetlabs-apache | = 1.10.0 | No fix listed |
| puppetlabs-apache | = 1.11.0 | No fix listed |
| puppetlabs-apache | = 2.0.0 | No fix listed |
| puppetlabs-apache | = prior to 1.11.1 and 2.1.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-2299 vendor-advisory
- 100859 third-party-advisory vdb-entry
- puppet.com vendor-advisory
- bugs.debian.org issue-tracking