CVE catalog

CVE-2017-2299

puppet-module-puppetlabs-apache: CVE-2017-2299

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.85% · Oct 25, 2026

Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpuppet-module-puppetlabs-apachesid12.2.0-2fixed
Debianpuppet-module-puppetlabs-apachetrixie12.2.0-1fixed
Debianpuppet-module-puppetlabs-apachebookworm5.5.0-2fixed
Ubuntupuppet-module-puppetlabs-apache16.041.1.1-1vulnerable
Ubuntupuppet-module-puppetlabs-apache16.041.6.0-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpuppet-module-puppetlabs-apachesourcesid3.0.0-1not yet assignedNot reported[875983]
Debianpuppet-module-puppetlabs-apachesourcetrixie3.0.0-1not yet assignedNot reported[875983]
Debianpuppet-module-puppetlabs-apachesourcebookworm3.0.0-1not yet assignedNot reported[875983]

[Debian bug #875983]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [puppet-module-puppetlabs-apache]Fixed
    Details (2)

    • 5.5.0-2 · all · bookworm

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · bookworm; dsa · puppet-module-puppetlabs-apache · debian · 12

    • 5.5.0-2 · all · bookworm

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · bookworm; dsa · puppet-module-puppetlabs-apache · debian · 12

[Debian 13 (Trixie)]

  • [puppet-module-puppetlabs-apache]Fixed
    Details (2)

    • 12.2.0-1 · all · trixie

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · 13

    • 12.2.0-1 · all · trixie

      Fixed · Fixed: 3.0.0-1

      dsa · puppet-module-puppetlabs-apache · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]