cveboard RSS feed

CVE-2020-7942

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2020
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Puppet

Vendor
Puppet
Product
Puppet
Platforms
Unknown
Default status
Unknown
Puppet · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.5.x prior to 5.5.19affectedUnavailableUnavailableUnavailableNone listed
Fixed in 5.5.19affectedUnavailableUnavailableUnavailableNone listed
6.x prior to 6.13.0affectedUnavailableUnavailableUnavailableNone listed
Fixed in 6.13.0affectedUnavailableUnavailableUnavailableNone listed

Puppet Agent

Vendor
Puppet
Product
Puppet Agent
Platforms
Unknown
Default status
Unknown
Puppet Agent · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.5.x prior to 5.5.19affectedUnavailableUnavailableUnavailableNone listed
Fixed in 5.5.19affectedUnavailableUnavailableUnavailableNone listed
6.x prior to 6.13.0affectedUnavailableUnavailableUnavailableNone listed
Fixed in 6.13.0affectedUnavailableUnavailableUnavailableNone listed