Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master
Puppet 6.13.0 and 5.5.19 changes the default behavior for
true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set
true to ensure secure behavior.
Thank you to Mark Frost with Lightning Source, LLC for finding and reporting this issue!
Affected software versions: