Which products and versions are affected by CVE-2020-7943?

Affected: PuppetDB versions >= prior to 6.9.1; Puppet Enterprise versions >= prior to 2019.5.0; Puppet Server versions >= prior to 6.9.2, among others. The full list is in the CVE brief.

Is CVE-2020-7943 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2020-7943 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2020-7943?

No public exploit code is known.

How urgently should CVE-2020-7943 be patched?

Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Request A Demo

Vulnerability Intelligence

CVE-2020-7943

High

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints.

Published Mar 11, 2020 · Updated Aug 5, 2026 · Also known as DEBIAN-CVE-2020-7943, UBUNTU-CVE-2020-7943

Key Facts

Patch in the next maintenance window

CVE-2020-7943 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting PuppetDB, Puppet Enterprise, Puppet Server and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 7.7% probability of exploitation in the next 30 days.
Fixed versions are available, including ansible-collection-redhat-satellite 0:1.3.0-1.el7sat, ansible-runner 0:1.4.6-1.el7ar, ansiblerole-foreman_scap_client 0:0.0.5-1.el7sat.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

CVSS v3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (30-day exploit likelihood)

7.7%

Higher than 94.5% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2020-7943 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13

Affected Products

408 affected entries in total

Product	Affected versions	Fixed in
PuppetDBPuppet	>= prior to 6.9.1	5.2.15
Puppet EnterprisePuppet	>= prior to 2019.5.0	2018.1.15
Puppet ServerPuppet	>= prior to 6.9.2	5.3.13
puppetdebian	See advisory	0
puppetserverdebian	See advisory	0

20 more affected products in the full CVE brief

Patched Releases

ansible-collection-redhat-satellite

0:1.3.0-1.el7sat

ansible-runner

0:1.4.6-1.el7ar

ansiblerole-foreman_scap_client

0:0.0.5-1.el7sat

ansiblerole-insights-client

0:1.7.1-1.el7sat

ansiblerole-satellite-receptor-installer

0:0.6.13-1.el7sat

candlepin

0:3.1.21-1.el7sat

createrepo_c

0:0.7.4-1.el7sat

foreman

0:2.1.2.19-1.el7sat

foreman-bootloaders-redhat

0:202005201200-1.el7sat

foreman-discovery-image

0:3.6.7-1

foreman-discovery-image-service

0:1.0.0-3.el7sat

foreman-installer

1:2.1.2.8-1.el7sat

foreman-proxy

0:2.1.2-2.el7sat

foreman-selinux

0:2.1.2.3-1.el7sat

future

0:0.16.0-11.el7sat

gofer

0:2.12.5-7.el7sat

hfsplus-tools

0:332.14-12.el7

katello

0:3.16.0-1.el7sat

katello-certs-tools

0:2.7.1-1.el7sat

katello-client-bootstrap

0:1.7.5-1.el7sat

katello-selinux

0:3.4.0-1.el7sat

keycloak-httpd-client-install

0:1.2.2-1.el7sat

kobo

0:0.5.1-1.el7sat

libmodulemd

0:1.7.0-1.pulp.el7sat

libsolv

0:0.7.4-4.pulp.el7sat

Timeline

Publicly disclosed
Mar 11, 2020
Last updated
Aug 5, 2026

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-276 Incorrect Default Permissions
CWE-1327 Binding to an Unrestricted IP Address

References

advisoryRHSA-2020:4366
advisoryhttps://puppet.com/security/cve/CVE-2020-7943/
advisoryhttps://security-tracker.debian.org/tracker/CVE-2020-7943
advisoryhttps://ubuntu.com/security/CVE-2020-7943
advisoryhttps://www.cve.org/CVERecord?id=CVE-2020-7943

FAQ

Common Questions.

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints.
Affected: PuppetDB versions >= prior to 6.9.1; Puppet Enterprise versions >= prior to 2019.5.0; Puppet Server versions >= prior to 6.9.2, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ansible-collection-redhat-satellite 0:1.3.0-1.el7sat, ansible-runner 0:1.4.6-1.el7ar, ansiblerole-foreman_scap_client 0:0.0.5-1.el7sat.
Brandefense priority: patch in the next maintenance window, because of its high severity, although no exploitation is known.

Is CVE-2020-7943 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.