CVE-2015-4100

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 3.7.x through 3.8.0

Description The issue allows remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master. This is related to a "Certificate Authority Reverse Proxy Vulnerability."

Recommendations For Puppet Enterprise versions 3.7.x through 3.8.0, consider restricting access to the certificate management functionality to prevent unauthorized node certificate management until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.