Detections
Analytics
SCA: security update for puppet (GHSA-gqvf-892r-vjm5)
medium Tenable Self-Hosted Container Security Plugin ID 415266
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Previously, Puppet operated on a model that a node with a valid certificate was entitled to all
information in the system and that a compromised certificate allowed access to everything in the
infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a
different node by modifying facts for the Puppet run. This issue can be mitigated by setting
`strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes
the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open
Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to
ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to
6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet
Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19 (CVE-2020-7942)
See Also
Plugin Details
Severity: Medium
ID: 415266
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2020-7942
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/13/2021
Vulnerability Publication Date: 2/19/2020
Reference Information
CVE: CVE-2020-7942
cwe: CWE-295