by Kastro
Paper/Archive/CVE-2022-0675

CVE-2022-0675

Puppet Firewall Module — Puppet Firewall Module May Leave Unmanaged Rules

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.2.602 × 2012.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.

Affected

ProductAffectedFixed inSource
Firewall Moduleprior to 3.4.0 – < 3.4.03.4.0CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
puppet (CNA)5.6CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

refpuppet.com/security/cve/CVE-2022-0675