cveboard RSS feed

CVE-2020-7943

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2020
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Puppet Enterprise 2018.1.x stream

Vendor
n/a
Product
Puppet Enterprise 2018.1.x stream
Platforms
Unknown
Default status
Unknown
Puppet Enterprise 2018.1.x stream · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
prior to 2018.1.13affectedUnavailableUnavailableUnavailableNone listed

Puppet Enterprise

Vendor
n/a
Product
Puppet Enterprise
Platforms
Unknown
Default status
Unknown
Puppet Enterprise · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
prior to 2019.5.0affectedUnavailableUnavailableUnavailableNone listed

Puppet Server

Vendor
n/a
Product
Puppet Server
Platforms
Unknown
Default status
Unknown
Puppet Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
prior to 6.9.2affectedUnavailableUnavailableUnavailableNone listed
prior to 5.3.12affectedUnavailableUnavailableUnavailableNone listed

PuppetDB

Vendor
n/a
Product
PuppetDB
Platforms
Unknown
Default status
Unknown
PuppetDB · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
prior to 6.9.1affectedUnavailableUnavailableUnavailableNone listed
prior to 5.2.13affectedUnavailableUnavailableUnavailableNone listed

Resolved in Puppet Enterprise, Puppet Server, PuppetDB

Vendor
n/a
Product
Resolved in Puppet Enterprise, Puppet Server, PuppetDB
Platforms
Unknown
Default status
Unknown
Resolved in Puppet Enterprise, Puppet Server, PuppetDB · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
Puppet Enterprise 2018.1.13 and 2019.5.0affectedUnavailableUnavailableUnavailableNone listed
Puppet Server 6.9.2 and 5.3.12affectedUnavailableUnavailableUnavailableNone listed
PuppetDB 6.9.1 and 5.2.13affectedUnavailableUnavailableUnavailableNone listed