CVE-2017-2299

Published: Sep 15, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.

Affected (26)

Products: Puppet: Puppetlabs Apache

Puppet

1 product

Puppetlabs Apache

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppetlabs Apache	Version 0.0.4
Puppet Puppetlabs Apache	Version 0.10.0
Puppet Puppetlabs Apache	Version 0.11.0
Puppet Puppetlabs Apache	Version 0.4.0
Puppet Puppetlabs Apache	Version 0.6.0
Puppet Puppetlabs Apache	Version 0.7.0
Puppet Puppetlabs Apache	Version 0.8.0
Puppet Puppetlabs Apache	Version 0.8.1
Puppet Puppetlabs Apache	Version 0.9.0
Puppet Puppetlabs Apache	Version 1.0.0
Puppet Puppetlabs Apache	Version 1.0.1
Puppet Puppetlabs Apache	Version 1.1.0
Puppet Puppetlabs Apache	Version 1.1.1
Puppet Puppetlabs Apache	Version 1.10.0
Puppet Puppetlabs Apache	Version 1.11.0
Puppet Puppetlabs Apache	Version 1.2.0
Puppet Puppetlabs Apache	Version 1.3.0
Puppet Puppetlabs Apache	Version 1.4.0
Puppet Puppetlabs Apache	Version 1.4.1
Puppet Puppetlabs Apache	Version 1.5.0
Puppet Puppetlabs Apache	Version 1.6.0
Puppet Puppetlabs Apache	Version 1.7.0
Puppet Puppetlabs Apache	Version 1.7.1
Puppet Puppetlabs Apache	Version 1.8.0
Puppet Puppetlabs Apache	Version 1.8.1
Puppet Puppetlabs Apache	Version 2.0.0