CVE-2023-5255 - Vulnerability Details - OpenCVE

For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00136.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Puppet	Puppet Puppet Server

Configuration 1 [-]

OR	cpe:2.3:a:puppet:puppet:2023.3::::enterprise:::
	cpe:2.3:a:puppet:puppet_server:8.2.0:::::::*
	cpe:2.3:a:puppet:puppet_server:8.2.1:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-57580	For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/advisories/GHSA-q3vx-5wxp-g986
https://nvd.nist.gov/vuln/detail/CVE-2023-5255
https://www.cve.org/CVERecord?id=CVE-2023-5255
https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates

History

Thu, 19 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: puppet

Published: 2023-10-03T17:54:55.177Z

Updated: 2024-09-19T19:29:30.230Z

Reserved: 2023-09-28T17:42:16.370Z

Link: CVE-2023-5255

Vulnrichment

Updated: 2024-08-02T07:52:08.537Z

NVD

Status : Modified

Published: 2023-10-03T18:15:10.577

Modified: 2024-11-21T08:41:23.090

Link: CVE-2023-5255

Redhat

Severity : Low

Publid Date: 2023-10-03T00:00:00Z

Links: CVE-2023-5255 - Bugzilla

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-5255", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "state": "PUBLISHED", "assignerShortName": "puppet", "dateReserved": "2023-09-28T17:42:16.370Z", "datePublished": "2023-10-03T17:54:55.177Z", "dateUpdated": "2024-09-19T19:29:30.230Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "Puppet Server", "product": "Puppet Enterprise", "vendor": "Puppet", "versions": [{"lessThanOrEqual": "2023.4", "status": "affected", "version": "Puppet Enterprise 2023.3", "versionType": "semver"}, {"lessThanOrEqual": "8.2.3", "status": "affected", "version": "Puppet Server 8.2.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. "}], "value": "For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. "}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "puppet", "dateUpdated": "2023-10-03T22:38:41.221Z"}, "references": [{"url": "https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates"}], "source": {"discovery": "UNKNOWN"}, "title": "Denial of Service for Revocation of Auto Renewed Certificates", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:52:08.537Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-19T19:29:18.354543Z", "id": "CVE-2023-5255", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-19T19:29:30.230Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:52:08.537Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-5255", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-19T19:29:18.354543Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-19T19:29:25.317Z"}}], "cna": {"title": "Denial of Service for Revocation of Auto Renewed Certificates", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Puppet", "product": "Puppet Enterprise", "versions": [{"status": "affected", "version": "Puppet Enterprise 2023.3", "versionType": "semver", "lessThanOrEqual": "2023.4"}, {"status": "affected", "version": "Puppet Server 8.2.0", "versionType": "semver", "lessThanOrEqual": "8.2.3"}], "packageName": "Puppet Server", "defaultStatus": "unaffected"}], "references": [{"url": "https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. ", "supportingMedia": [{"type": "text/html", "value": "For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. ", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-404", "description": "CWE-404 Improper Resource Shutdown or Release"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "puppet", "dateUpdated": "2023-10-03T22:38:41.221Z"}}}, "cveMetadata": {"cveId": "CVE-2023-5255", "state": "PUBLISHED", "dateUpdated": "2024-09-19T19:29:30.230Z", "dateReserved": "2023-09-28T17:42:16.370Z", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "datePublished": "2023-10-03T17:54:55.177Z", "assignerShortName": "puppet"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:2023.3:*:*:*:enterprise:*:*:*", "matchCriteriaId": "8E4196F0-B1C3-46EF-A17C-6404E9E34CB3", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_server:8.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "5463CE94-DD76-4DBE-B124-3B87B8627A9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_server:8.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B7891ED2-94F2-4017-8172-BD04E66CB792", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked. "}, {"lang": "es", "value": "Para los certificados que utilizan la funci\u00f3n de renovaci\u00f3n autom\u00e1tica en Puppet Server, existe una falla que impide que los certificados sean revocados."}], "id": "CVE-2023-5255", "lastModified": "2024-11-21T08:41:23.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "security@puppet.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-03T18:15:10.577", "references": [{"source": "security@puppet.com", "tags": ["Vendor Advisory"], "url": "https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.puppet.com/security/cve/cve-2023-5255-denial-service-revocation-auto-renewed-certificates"}], "sourceIdentifier": "security@puppet.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-404"}], "source": "security@puppet.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-404"}], "source": "nvd@nist.gov", "type": "Primary"}]}