CVE-2023-1894: Medium severity puppet Puppet Enterprise vulnerability
A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/puppet-serverto a version that resolves this vulnerability.Fixed in 7.11.0 - Upgrade
Upgrade
redhat/puppet-serverto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2023-1894.
What is the severity of CVE-2023-1894?
The severity of CVE-2023-1894 is medium with a CVSS score of 5.3.
Which software versions are affected by CVE-2023-1894?
Puppet Server 7.9.2 and Puppet Enterprise versions 2021.7.1 and 2023.0 are affected by CVE-2023-1894.
What is the impact of CVE-2023-1894?
CVE-2023-1894 can significantly slow down server operations due to a Regular Expression Denial of Service (ReDoS) issue in certificate validation.
How can I fix CVE-2023-1894?
To fix CVE-2023-1894, you should upgrade to a patched version of Puppet Server or Puppet Enterprise as recommended by the vendor.