CVE-2017-2299 | BDVDB-2026-90519 Detail

Puppetpuppetlabs-apache

Description#

Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://www.securityfocus.com/bid/100859
https://puppet.com/security/cve/CVE-2017-2299

Exploit#

No public exploit known

History#

Version 12017-09-15Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.