Debian patches Trapperkeeper flaw that exposed Puppet host catalogues
VULNERABILITYredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Debian has released DSA-6609-1 for trapperkeeper-authorization-clojure. Incorrect validation of hostname ACLs in the Trapperkeeper authorisation service could let a Puppet client download the catalogue of a different host. Administrators running Puppet servers on Debian should apply the update.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Apply the Debian security update DSA-6609-1 to the trapperkeeper-authorization-clojure package.
- Check whether your Puppet servers run Trapperkeeper with this package installed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Debian Security Advisories