The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
The product does not validate, or incorrectly validates, a certificate.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Puppet | Puppet | * | 3.6.2 (excluding) |
| Puppet | Ubuntu | esm-infra-legacy/trusty | * |
| Puppet | Ubuntu | trusty | * |
| Puppet | Ubuntu | trusty/esm | * |
| Puppet | Ubuntu | upstream | * |