DEBIAN-CVE-2014-3250

The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4...

DEBIAN-CVE-2017-2299

Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the sslca parameter but do not specify the sslcertsdir parameter, a default will be provided for the sslcertsdir that will trust certificates from any of the...

PT-2017-15335

Name of the Vulnerable Software and Affected Versions puppetlabs-apache versions prior to 1.11.1 puppetlabs-apache versions prior to 2.1.0 Description The issue makes it easy to accidentally misconfigure TLS trust. If the ssl ca parameter is specified but the ssl certs dir parameter is not, a...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection...

CVE-2012-2132

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection...

CVE-2012-2132: Improper Authentication

libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection...