TI-2020-06423 Aliases CVE-2020-7942 GHSA-gqvf-892r-vjm5

Improper certificate validation in Puppet

LOW 30CWE-295Published 2020-02-19 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: High · None · None
Fix status: Partial Red Hat: 2 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

Why it matters now

EPSS 0.00801 56th percentileScored 2026-11-07

Fix Partial Puppet (Puppet): 5.5.19, 6.13.0Puppet Agent (Puppet): 5.5.19, 6.13.0+1 more productRed Hat: 1 advisoryRed Hat: 2 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Puppet	Puppet	5.5 to before 5.5.19; Fixed in 5.5.19; 6 to before 6.13.0; Fixed in 6.13.0	5.5.19, 6.13.0	Patch available	CNA
Puppet	Puppet Agent	5.5 to before 5.5.19; Fixed in 5.5.19; 6 to before 6.13.0; Fixed in 6.13.0	5.5.19, 6.13.0	Patch available	CNA
—	puppet (RubyGems)	6.0.0 to before 6.13.0	6.13.0	Patch available	GHSA-gqvf-892r-vjm5
—	puppet (RubyGems)	before 5.5.19	5.5.19	Patch available	GHSA-gqvf-892r-vjm5

Puppet VendorPuppet Affected 5.5 to before 5.5.19; Fixed in 5.5.19; 6 to before 6.13.0; Fixed in 6.13.0 Fixed in 5.5.19, 6.13.0 Patch available CNA
Puppet Agent VendorPuppet Affected 5.5 to before 5.5.19; Fixed in 5.5.19; 6 to before 6.13.0; Fixed in 6.13.0 Fixed in 5.5.19, 6.13.0 Patch available CNA
puppet (RubyGems) Vendor— Affected 6.0.0 to before 6.13.0 Fixed in 6.13.0 Patch available GHSA-gqvf-892r-vjm5
puppet (RubyGems) Vendor— Affected before 5.5.19 Fixed in 5.5.19 Patch available GHSA-gqvf-892r-vjm5

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:puppet:puppet::::::::	5.5.0 to before 5.5.19; 6.0.0 to before 6.13.0	Vulnerable	Puppet
cpe:2.3:a:puppet:puppet_agent::::::::	5.5.0 to before 5.5.19; 6.0.0 to before 6.13.0	Vulnerable	Puppet

cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:* Versions 5.5.0 to before 5.5.19; 6.0.0 to before 6.13.0 Vulnerable ·Puppet
cpe:2.3:a:puppet:puppet_agent:*:*:*:*:*:*:*:* Versions 5.5.0 to before 5.5.19; 6.0.0 to before 6.13.0 Vulnerable ·Puppet

Remediation

Fix · CNA Puppet (Puppet) Fixed in 5.5.19, 6.13.0
Fix · CNA Puppet Agent (Puppet) Fixed in 5.5.19, 6.13.0
Fix · GHSA-gqvf-892r-vjm5 puppet (RubyGems) Fixed in 6.13.0 Advisory →
Fix · GHSA-gqvf-892r-vjm5 puppet (RubyGems) Fixed in 5.5.19 Advisory →

Red Hat 1 advisory

RHSA-2020:4366 Released 2020-10-27 · Red Hat rating Important
Satellite 6.8 release
- Red Hat Satellite 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
- Red Hat Satellite Capsule 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 10 (Newton)	Affected	No fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 15 (Stein)	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 16.1	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 16.2	Affected	No fix planned: Will not fix
Red Hat Update Infrastructure 3 for Cloud Providers	Affected	No fix yet: Fix deferred
Red Hat Satellite 6.8	Fixed	RHSA-2020:4366
Red Hat Satellite Capsule 6.8	Fixed	RHSA-2020:4366

Timeline

2026-10-02 Threatist record created from CVE-2020-7942
2026-10-03 Alias added: GHSA-gqvf-892r-vjm5

References

Advisory 2

Other 2

TI-2016-02327 Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet… CVSS 3.1CRITICAL 9.8
TI-2013-01442 The (1) template and (2) inline_template functions in the master server in Puppet before… CVSS 2.0HIGH 9.0
TI-2021-08594 SQL injection in Puppet DB CVSS 3.1HIGH 8.8
TI-2017-01576 Deserialization of untrusted data in Puppet server CVSS 3.0HIGH 8.2
TI-2018-04793 Untrusted search path in Puppet Enterprise and Puppet Agent CVSS 3.0HIGH 8.8
TI-2013-01456 Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later… CVSS 2.0HIGH 7.5

See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences