PT-2019-8792

CVE-2018-11747

·

Published

2019-03-17

·

Updated

2020-12-16

Description by

CVSS 3.1
9.8
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Puppet Discovery versions prior to 1.4.0
Description The issue concerns a default generated TLS certificate in the nginx container. Previously, Puppet Discovery was shipped with this default certificate. In version 1.4.0, a unique certificate will be generated on installation, or the user will be able to provide their own TLS certificate for ingress.
Recommendations For versions prior to 1.4.0, update to version 1.4.0 to generate a unique TLS certificate on installation or provide your own TLS certificate for ingress.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-295: Improper Certificate Validation
Related identifiers
CVE-2018-11747
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com