CVE-2020-7942 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-7942 Interim 1 17 2025-02-17T01:36:54Z current 2021-05-30T14:37:36Z 2025-02-17T01:36:54Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-7942 Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2020-April/006721.html E-Mail link for SUSE-SU-2020:1057-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Server 11 SP1-TERADATA SUSE Linux Enterprise Server 11 SP3-TERADATA SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Advanced Systems Management 12 SUSE Linux Enterprise Module for Advanced Systems Management 12 puppet puppet-2.7.26-0.5.6.1 puppet-3.8.5-15.12.1 puppet-server-2.7.26-0.5.6.1 puppet-server-3.8.5-15.12.1 puppet-3.8.5-15.12.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 puppet-server-3.8.5-15.12.1 as a component of SUSE Linux Enterprise Module for Advanced Systems Management 12 puppet-2.7.26-0.5.6.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA puppet-server-2.7.26-0.5.6.1 as a component of SUSE Linux Enterprise Server 11 SP1-TERADATA puppet-2.7.26-0.5.6.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA puppet-server-2.7.26-0.5.6.1 as a component of SUSE Linux Enterprise Server 11 SP3-TERADATA puppet as a component of SUSE Linux Enterprise Server 11 SP4 LTSS Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19 CVE-2020-7942 SUSE Linux Enterprise Module for Advanced Systems Management 12:puppet-3.8.5-15.12.1 SUSE Linux Enterprise Module for Advanced Systems Management 12:puppet-server-3.8.5-15.12.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:puppet-2.7.26-0.5.6.1 SUSE Linux Enterprise Server 11 SP1-TERADATA:puppet-server-2.7.26-0.5.6.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:puppet-2.7.26-0.5.6.1 SUSE Linux Enterprise Server 11 SP3-TERADATA:puppet-server-2.7.26-0.5.6.1 moderate 4 AV:N/AC:L/Au:S/C:P/I:N/A:N 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N