Read the docs
TI-2020-06424 Aliases CVE-2020-7943GHSA-xv72-7w5r-cqjw

Incorrect default permissions in Puppet Enterprise 2018.1.x stream

Priority MEDIUM 43CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Why it matters now

EPSS 0.07674 94th percentileScored 2026-11-07
Fix Fixed Puppet Enterprise 2018.1.x stream: 2018.1.13Puppet Enterprise: 2019.5.0+2 more productsRed Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Puppet Enterprise 2018.1.x streambefore 2018.1.132018.1.13Patch availableCNA
—Puppet Enterprisebefore 2019.5.02019.5.0Patch availableCNA
—Puppet Serverbefore 6.9.2; before 5.3.126.9.2, 5.3.12Patch availableCNA
—PuppetDBbefore 6.9.1; before 5.2.136.9.1, 5.2.13Patch availableCNA
—Resolved in Puppet Enterprise, Puppet Server, PuppetDBPuppet Enterprise 2018.1.13 and 2019.5.0; Puppet Server 6.9.2 and 5.3.12; PuppetDB 6.9.1 and 5.2.13—No fix listedCNA
  • Puppet Enterprise 2018.1.x stream Vendor— Affected before 2018.1.13 Fixed in 2018.1.13 Patch available CNA
  • Puppet Enterprise Vendor— Affected before 2019.5.0 Fixed in 2019.5.0 Patch available CNA
  • Puppet Server Vendor— Affected before 6.9.2; before 5.3.12 Fixed in 6.9.2, 5.3.12 Patch available CNA
  • PuppetDB Vendor— Affected before 6.9.1; before 5.2.13 Fixed in 6.9.1, 5.2.13 Patch available CNA
  • Resolved in Puppet Enterprise, Puppet Server, PuppetDB Vendor— Affected Puppet Enterprise 2018.1.13 and 2019.5.0; Puppet Server 6.9.2 and 5.3.12; PuppetDB 6.9.1 and 5.2.13 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*2018.1.0 to before 2018.1.15; 2019.0 to before 2019.7.0VulnerablePuppet
cpe:2.3:a:puppet:puppet_server:*:*:*:*:*:*:*:*before 5.3.13; 6.0.0 to before 6.11.1VulnerablePuppet
cpe:2.3:a:puppet:puppetdb:*:*:*:*:*:*:*:*before 5.2.15; 6.0.0 to before 6.10.1VulnerablePuppet
  • cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* Versions 2018.1.0 to before 2018.1.15; 2019.0 to before 2019.7.0 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet_server:*:*:*:*:*:*:*:* Versions before 5.3.13; 6.0.0 to before 6.11.1 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppetdb:*:*:*:*:*:*:*:* Versions before 5.2.15; 6.0.0 to before 6.10.1 Vulnerable ·Puppet

Remediation

  • Fix · CNA Puppet Enterprise 2018.1.x stream Fixed in 2018.1.13
  • Fix · CNA Puppet Enterprise Fixed in 2019.5.0
  • Fix · CNA Puppet Server Fixed in 6.9.2, 5.3.12
  • Fix · CNA PuppetDB Fixed in 6.9.1, 5.2.13

Red Hat 1 advisory

  • RHSA-2020:4366 Released 2020-10-27 · Red Hat rating Important
    Satellite 6.8 release
    • Red Hat Satellite 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47
    • Red Hat Satellite Capsule 6.8 ansible-collection-redhat-satellite-1.3.0-1.el7sat, ansible-runner-1.4.6-1.el7ar, ansiblerole-foreman_scap_client-0.0.5-1.el7sat +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6.8Fixed RHSA-2020:4366
Red Hat Satellite Capsule 6.8Fixed RHSA-2020:4366
Not affected: 5 products
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 15 (Stein)
  • Red Hat OpenStack Platform 16 (Train)
  • Red Hat Update Infrastructure 3 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7943
  2. 2026-10-03 Alias added: GHSA-xv72-7w5r-cqjw
  3. 2026-10-05 EPSS moved to the 95th–99th percentile
  4. 2026-10-18 EPSS moved to the 90th–95th percentile

References

Advisory 1

  • TI-2017-05170 Integer overflow in nginx CVSS 3.1HIGH 7.5
  • TI-2023-02371 A privilege escalation allowing remote code execution was discovered in the orchestration service. CVSS 3.1CRITICAL 9.8
  • TI-2013-01442 The (1) template and (2) inline_template functions in the master server in Puppet before… CVSS 2.0HIGH 9.0
  • TI-2018-04792 Code injection in Puppet Enterprise 2018.1.x prior to 2018.1.1, razor-server and… CVSS 3.0CRITICAL 9.8
  • TI-2016-02330 MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote… CVSS 3.0CRITICAL 9.8
  • TI-2021-08596 A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP… CVSS 3.1CRITICAL 9.8
See all 88 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences