Input validation error in Puppet Firewall Module - CVE-2022-0675
Published: June 27, 2022
Vulnerability identifier: #VU64691
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-0675
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to in certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
Puppet Firewall Module
Red Hat OpenStack
puppet-firewall (Red Hat package)
Red Hat OpenStack
puppet-firewall (Red Hat package)
How to mitigate CVE-2022-0675
Install updates from vendor's website.
Puppet Firewall Module - update to 3.4.0
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.3
puppet-firewall (Red Hat package) - update to 3.4.0-1.94f707cgit.el8ost
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.3
puppet-firewall (Red Hat package) - update to 3.4.0-1.94f707cgit.el8ost