CVE-2018-11750

Published: Oct 2, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, host key checking is enabled by default.

Affected (1)

Products: Puppet: Cisco Ios Module

Puppet

1 product

Cisco Ios Module

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Puppet Cisco Ios Module	Before 0.4.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://puppet.com/security/cve/CVE-2018-11750

Source: security@puppet.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/150978

Source: nvd@nist.gov

Vendor Advisory

https://puppet.com/security/cve/CVE-2018-11750

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.