CVE-2017-2299: High severity Puppet Puppetlabs-apache Puppet vulnerability
Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the sslca parameter but do not specify the sslcertsdir parameter, a default will be provided for the sslcertsdir that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2299?
CVE-2017-2299 has a medium severity, potentially allowing misconfiguration of TLS trust if parameters are improperly specified.
How do I fix CVE-2017-2299?
To fix CVE-2017-2299, ensure that both the 'ssl_ca' and 'ssl_certs_dir' parameters are specified correctly in your Puppet configuration.
Which versions are affected by CVE-2017-2299?
CVE-2017-2299 affects puppetlabs-apache versions prior to 1.11.1 and 2.1.0.
What will happen if I don't address CVE-2017-2299?
Failure to address CVE-2017-2299 may result in accepting untrusted TLS certificates, leading to potential security risks.
Is upgrading to a newer version sufficient to resolve CVE-2017-2299?
Yes, upgrading puppetlabs-apache to version 1.11.1 or 2.1.0 or later addresses the vulnerability.