CVE-2018-11747

CRITICAL 9.8CVE-2018-11747 · Published 21/03/2019 · updated 17/06/2026

In short

CVE-2018-11747 is a CRITICAL (CVSS 9.8) vulnerability affecting discovery (puppet).
Chance of exploitation in the next 30 days (EPSS): 0.72%, higher than 54.1% of all vulnerabilities.
Fix: update to 1.4.0 or later.

Package	Affected versions	Patched versions
discovery puppet	`< 1.4.0`	`1.4.0`

Description

Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.

References

lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
puppet.com/security/cve/CVE-2018-11747 · Vendor Advisory

More vulnerabilities in discovery

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free