Ubuntu.comUB:CVE-2014-3250CVE-2014-3250
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
45.0%
The default vhost configuration file in Puppet before 3.6.2 does not
include the SSLCARevocationCheck directive, which might allow remote
attackers to obtain sensitive information via a revoked certificate when a
Puppet master runs with Apache 2.4.
Notes
| Author | Note |
|---|---|
| sbeattie | triggered under apache 2.4 only |
| mdeslaur | later Debian packages don’t enable SSLCARevocationCheck by default, just simply add it as a commented-out example to the config file. We are not going to fix this in Ubuntu 14.04 LTS. If this is required, it can simply be added to the local configuration. |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
45.0%