CVE-2018-11746: Puppet Discovery can leak authentication information
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-11746?
The severity of CVE-2018-11746 is critical (9.8).
How does CVE-2018-11746 impact Puppet Discovery?
CVE-2018-11746 allows for insecure WinRM connections in Puppet Discovery, potentially exposing login credentials.
What software versions are affected by CVE-2018-11746?
Version up to (but not including) 1.2.0 of Puppet Discovery are affected by CVE-2018-11746.
How can I mitigate the vulnerability in CVE-2018-11746?
To mitigate the vulnerability in CVE-2018-11746, ensure that a HTTPS server is available for WinRM connections in Puppet Discovery.
Where can I find more information about CVE-2018-11746?
More information about CVE-2018-11746 can be found at the following references: [Reference 1](https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E) and [Reference 2](https://puppet.com/security/cve/CVE-2018-11746).