CVE-2018-11747
Critical
Description
Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.
SeverityCritical
CVSS9.8
Exploit probability—
ProductPuppet Discovery
PublishedMar 21, 2019
First seenMar 21, 2019
How to fix
Update
- puppet discovery1.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| puppet discovery | v < 1.4.0 | 1.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.