Description
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://puppet.com/security/cve/CVE-2014-3250
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1101347
Scores
CVSS v3
6.5
EPSS
0.0089
EPSS Percentile
54.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-295
Status
published
Products (2)
puppet/puppet
< 3.6.2
redhat/linux
Published
Dec 11, 2017
Tracked Since
Feb 18, 2026