Vulnerability · Published Mar 2, 2022 · Assigned by puppet
CVE-2022-0675Puppet Firewall Module May Leave Unmanaged Rules
Medium 5.6
In plain English
A medium-severity security flaw in Firewall Module from Puppet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.9%top 39.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | puppet-module-puppetlabs-firewall | 3.4.0-1 | DEBIAN-CVE-2022-0675 |
| Debian:13 | puppet-module-puppetlabs-firewall | 3.4.0-1 | DEBIAN-CVE-2022-0675 |
| Debian:14 | puppet-module-puppetlabs-firewall | 3.4.0-1 | DEBIAN-CVE-2022-0675 |
| Ubuntu:22.04:LTS | puppet-module-puppetlabs-firewall | no fix listed | UBUNTU-CVE-2022-0675 |
| Ubuntu:24.04:LTS | puppet-module-puppetlabs-firewall | no fix listed | UBUNTU-CVE-2022-0675 |
| Ubuntu:25.10 | puppet-module-puppetlabs-firewall | no fix listed | UBUNTU-CVE-2022-0675 |
| Ubuntu:26.04:LTS | puppet-module-puppetlabs-firewall | no fix listed | UBUNTU-CVE-2022-0675 |
| Ubuntu:26.10 | puppet-module-puppetlabs-firewall | no fix listed | UBUNTU-CVE-2022-0675 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Puppet | Firewall Module | prior to 3.4.0 – before 3.4.0 |
Weakness: CWE-1289 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
References
- https://puppet.com/security/cve/CVE-2022-0675 x_refsource_MISC