Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a…

Description

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19

Scores

EPSS (exploitation in 30 days)

0.80% · top 43% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.

Weakness

• Arbitrary retrieval
• CWE-295 (opens in a new tab)All about CWE-295 and its CVEs

Affected products

• Puppet · Puppet

  • affected 5.5.x prior to 5.5.19
  • affected Fixed in 5.5.19
  • affected 6.x prior to 6.13.0
  • affected Fixed in 6.13.0

• Puppet · Puppet Agent

  • affected 5.5.x prior to 5.5.19
  • affected Fixed in 5.5.19
  • affected 6.x prior to 6.13.0
  • affected Fixed in 6.13.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• RubyGemspuppetGHSA-gqvf-892r-vjm5 (opens in a new tab)

References (1)

• https://puppet.com/security/cve/CVE-2020-7942/ (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-gqvf-892r-vjm5 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-7942](https://trackcve.app/badge/CVE-2020-7942.svg)](https://trackcve.app/cve/CVE-2020-7942)

Record last updated 4 Aug 2024, 09:48 UTC.