CVE-2014-3250 Security feature bypass in n/a
Attackers can bypass certificate revocation checks in Puppet's default Apache configuration, potentially accessing sensitive information via revoked certificates.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3250?
CVE-2014-3250 is a medium-severity vulnerability in Redhat Linux, published on 11 Dec 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
Weakness: CWE-295
Which versions are affected by CVE-2014-3250?
It affects 2 products.
Products include Puppet Puppet, Redhat Linux.
How do I fix CVE-2014-3250?
Upgrade to a fixed version.
Is CVE-2014-3250 being exploited?
There is no known exploitation of CVE-2014-3250 in the wild and no public exploit code.
Other vulnerabilities in Redhat Linux
Sources
Also known as DEBIAN-CVE-2014-3250, GHSA-mmpq-gqvm-78gf, UBUNTU-CVE-2014-3250.