CVE-2014-3250

medium Apache
CVSS v3 Base Score
6.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.3%
Exploitation probability in 30 days
Top 51% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Confidentiality
High
Integrity
None
Availability
None
Published: December 11, 2017 (3076 days ago)
Last Modified: May 13, 2026
Vendor: Apache
Source: NVD

Description

The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.

CWE

CWE-295

Affected Products

puppet puppetredhat linux

References

🔗 bugzilla.redhat.com 🔗 puppet.com 🔗 bugzilla.redhat.com 🔗 puppet.com