CVE-2023-1894

MEDIUM

Puppet Server 7.9.2 - Regular Expression Denial of Service in Certificate Validation

Title source: llm

Description

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.

References (1)

Core 1

Core References

Vendor Advisory

https://www.puppet.com/security/cve/cve-2023-1894-puppet-server-redos

Scores

CVSS v3 5.3

EPSS 0.0044

EPSS Percentile 34.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-1333

Status published

Products (3)

puppet/puppet_enterprise 2021.7.1

puppet/puppet_enterprise 2023.0

puppet/puppet_server 7.9.2

Published May 04, 2023

Tracked Since Feb 18, 2026