CVE catalog

CVE-2023-1894

puppetserver: CVE-2023-1894

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpuppetserversid8.7.0-7fixed
Debianpuppetservertrixie8.7.0-5fixed
Debianpuppetserverbookworm7.9.5-2+deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpuppetserversourcesid7.9.5-2not yet assignedNot reported[1035541]
Debianpuppetserversourcetrixie7.9.5-2not yet assignedNot reported[1035541]
Debianpuppetserversourcebookworm7.9.5-2not yet assignedNot reported[1035541]

[Debian bug #1035541]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]