Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the ssl_ca parameter but do not specify the ssl_certs_dir parameter, a default will be provided for the ssl_certs_dir that will trust certificates from any of the system-trusted certificate authorities. This did not affect FreeBSD.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Puppetlabs-apache | Puppet | 0.0.4 (including) | 0.0.4 (including) |
| Puppetlabs-apache | Puppet | 0.4.0 (including) | 0.4.0 (including) |
| Puppetlabs-apache | Puppet | 0.6.0 (including) | 0.6.0 (including) |
| Puppetlabs-apache | Puppet | 0.7.0 (including) | 0.7.0 (including) |
| Puppetlabs-apache | Puppet | 0.8.0 (including) | 0.8.0 (including) |
| Puppetlabs-apache | Puppet | 0.8.1 (including) | 0.8.1 (including) |
| Puppetlabs-apache | Puppet | 0.9.0 (including) | 0.9.0 (including) |
| Puppetlabs-apache | Puppet | 0.10.0 (including) | 0.10.0 (including) |
| Puppetlabs-apache | Puppet | 0.11.0 (including) | 0.11.0 (including) |
| Puppetlabs-apache | Puppet | 1.0.0 (including) | 1.0.0 (including) |
| Puppetlabs-apache | Puppet | 1.0.1 (including) | 1.0.1 (including) |
| Puppetlabs-apache | Puppet | 1.1.0 (including) | 1.1.0 (including) |
| Puppetlabs-apache | Puppet | 1.1.1 (including) | 1.1.1 (including) |
| Puppetlabs-apache | Puppet | 1.2.0 (including) | 1.2.0 (including) |
| Puppetlabs-apache | Puppet | 1.3.0 (including) | 1.3.0 (including) |
| Puppetlabs-apache | Puppet | 1.4.0 (including) | 1.4.0 (including) |
| Puppetlabs-apache | Puppet | 1.4.1 (including) | 1.4.1 (including) |
| Puppetlabs-apache | Puppet | 1.5.0 (including) | 1.5.0 (including) |
| Puppetlabs-apache | Puppet | 1.6.0 (including) | 1.6.0 (including) |
| Puppetlabs-apache | Puppet | 1.7.0 (including) | 1.7.0 (including) |
| Puppetlabs-apache | Puppet | 1.7.1 (including) | 1.7.1 (including) |
| Puppetlabs-apache | Puppet | 1.8.0 (including) | 1.8.0 (including) |
| Puppetlabs-apache | Puppet | 1.8.1 (including) | 1.8.1 (including) |
| Puppetlabs-apache | Puppet | 1.10.0 (including) | 1.10.0 (including) |
| Puppetlabs-apache | Puppet | 1.11.0 (including) | 1.11.0 (including) |
| Puppetlabs-apache | Puppet | 2.0.0 (including) | 2.0.0 (including) |
| Puppet-module-puppetlabs-apache | Ubuntu | artful | * |
| Puppet-module-puppetlabs-apache | Ubuntu | esm-apps/xenial | * |
| Puppet-module-puppetlabs-apache | Ubuntu | trusty | * |
| Puppet-module-puppetlabs-apache | Ubuntu | upstream | * |
| Puppet-module-puppetlabs-apache | Ubuntu | xenial | * |
| Puppet-module-puppetlabs-apache | Ubuntu | zesty | * |