CVE-2018-6517

CVE-2018-6517 describes a vulnerability in puppet chloride versions prior to 0.3.0, where the application would automatically add host fingerprints for unknown hosts to the user's known_hosts file without confirmation. This vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity that could lead to high integrity impact, specifically the unauthorized modification of the known_hosts file. While the vulnerability is significant, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or community discussion surrounding it. The issue has been addressed in chloride version 0.3.0, which no longer updates the known_hosts file.