A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-loggingUpgrade rubygem-unf_extUpgrade rubygem-version_gemUpgrade rubygem-http-acceptUpgrade satellite-maintainUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-powerbarUpgrade rubygem-clampUpgrade rubygem-localeUpgrade rubygem-ffi-debuginfoUpgrade foreman-cliUpgrade rubygem-hashieUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foreman_templatesUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffi-debugsourceUpgrade rubygem-netrcUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-rest-clientUpgrade rubygem-http-cookieUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-foreman_maintainUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cliUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cloneUpgrade rubygem-unfUpgrade rubygem-oauth-ttyUpgrade satellite-cliUpgrade rubygem-oauthUpgrade rubygem-multi_jsonUpgrade rubygem-amazing_printUpgrade rubygem-mime-types-dataUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unicode-display_widthUpgrade rubygem-snaky_hashUpgrade rubygem-little-pluggerUpgrade rubygem-unicodeUpgrade rubygem-ffiUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debugsource | Nov 13, 2023 | May 4, 2023 |
| Debian | — | Upgrade puppetserver | Jul 30, 2024 | May 4, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-oauth-ttyUpgrade rubygem-oauthUpgrade rubygem-highlineUpgrade rubygem-unicode-debuginfoUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_adminUpgrade foreman-cliUpgrade satellite-cloneUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-domain_nameUpgrade rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade rubygem-unicode-display_widthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-unfUpgrade rubygem-gssapiUpgrade rubygem-apipie-bindingsUpgrade rubygem-amazing_printUpgrade rubygem-rest-clientUpgrade python39-pulp_manifestUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-netrcUpgrade rubygem-unf_extUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-http-acceptUpgrade satellite-cliUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-multi_jsonUpgrade rubygem-ffi-debugsourceUpgrade rubygem-clampUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-localeUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-jwtUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-version_gemUpgrade satellite-maintainUpgrade rubygem-unicode-debugsourceUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-loggingUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_azure_rm | Nov 13, 2023 | May 4, 2023 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfo | Mar 5, 2024 | May 4, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub