CVE-2023-1894: Medium severity puppet Puppet Enterprise vulnerability
Published May 4, 2023
·Updated
A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.
Affected Software
5 affected componentsFixes available
redhat/puppet-server<7.11.0
7.11.0
redhat/puppet-server<8.0.0
8.0.0
puppet Puppet Enterprise=2021.7.1
puppet Puppet Enterprise=2023.0
Puppet Puppet Server=7.9.2
Event History
May 4, 2023
Data Sourced
via Red Hat·09:57 AM
DescriptionSeverityAffected Software
CVE Published
via MITRE·10:13 PM
Data Sourced
via MITRE·10:13 PM
DescriptionWeakness
Data Sourced
11:15 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2023-1894.
2
What is the severity of CVE-2023-1894?
The severity of CVE-2023-1894 is medium with a CVSS score of 5.3.
3
Which software versions are affected by CVE-2023-1894?
Puppet Server 7.9.2 and Puppet Enterprise versions 2021.7.1 and 2023.0 are affected by CVE-2023-1894.
4
What is the impact of CVE-2023-1894?
CVE-2023-1894 can significantly slow down server operations due to a Regular Expression Denial of Service (ReDoS) issue in certificate validation.
5
How can I fix CVE-2023-1894?
To fix CVE-2023-1894, you should upgrade to a patched version of Puppet Server or Puppet Enterprise as recommended by the vendor.