Lucene search

[email protected]CVE-2023-5255

HistoryOct 03, 2023 - 6:15 p.m.

CVE-2023-5255

2023-10-0318:15:10

CWE-404

[email protected]

web.nvd.nist.gov

145

cve-2023-5255

puppet server

certificate

auto-renew

flaw

revocation

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0005 Low

EPSS

Percentile

15.9%

JSON

For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

CPENameOperatorVersion
puppet:puppetpuppeteq2023.3
puppet:puppet_serverpuppet puppet servereq8.2.0
puppet:puppet_serverpuppet puppet servereq8.2.1

CPE	Name	Operator	Version
puppet:puppet	puppet	eq	2023.3
puppet:puppet_server	puppet puppet server	eq	8.2.0
puppet:puppet_server	puppet puppet server	eq	8.2.1

References

www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.0005 Low

EPSS

Percentile

15.9%

JSON

Related for CVE-2023-5255

redhatcve1 ubuntucve1 debiancve1 cvelist1 prion1 osv2