CVE-2014-3250

The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2017-12-11

Last modified

2024-08-06

Weaknesses

CWE-295

Affected products

• Puppet (Puppet)
• Linux (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1101347
• https://puppet.com/security/cve/CVE-2014-3250