Vulnerabilites related to puppetlabs - puppet
CVE-2012-3408 (GCVE-0-2012-3408)
Vulnerability from cvelistv5
Published
2012-08-06 16:00
Modified
2024-08-06 20:05
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:05:12.457Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839166"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3408/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-06T16:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839166"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3408/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2012-3408",
"datePublished": "2012-08-06T16:00:00Z",
"dateReserved": "2012-06-14T00:00:00Z",
"dateUpdated": "2024-08-06T20:05:12.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-2716 (GCVE-0-2013-2716)
Vulnerability from cvelistv5
Published
2013-04-10 15:00
Modified
2024-08-06 15:44
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:44:33.451Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "puppet-cve20132716-sec-bypass(83171)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83171"
},
{
"name": "52862",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52862"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2716/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet Labs Puppet Enterprise before 2.8.0 does not use a \"randomized secret\" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "puppet-cve20132716-sec-bypass(83171)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83171"
},
{
"name": "52862",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52862"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2716/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-2716",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet Labs Puppet Enterprise before 2.8.0 does not use a \"randomized secret\" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "puppet-cve20132716-sec-bypass(83171)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83171"
},
{
"name": "52862",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/52862"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-2716/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-2716/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-2716",
"datePublished": "2013-04-10T15:00:00",
"dateReserved": "2013-03-27T00:00:00",
"dateUpdated": "2024-08-06T15:44:33.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-3865 (GCVE-0-2012-3865)
Vulnerability from cvelistv5
Published
2012-08-06 16:00
Modified
2024-08-06 20:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:21:04.052Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2012:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-07-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-08T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2012:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-3865",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2012:0983",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"name": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f",
"refsource": "CONFIRM",
"url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
},
{
"name": "DSA-2511",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"name": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6",
"refsource": "CONFIRM",
"url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=839131",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-3865/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-3865",
"datePublished": "2012-08-06T16:00:00",
"dateReserved": "2012-07-06T00:00:00",
"dateUpdated": "2024-08-06T20:21:04.052Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-3867 (GCVE-0-2012-3867)
Vulnerability from cvelistv5
Published
2012-08-06 16:00
Modified
2024-08-06 20:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:21:04.014Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2012:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-07-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-08T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2012:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-3867",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2012:0983",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"name": "DSA-2511",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-3867/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
},
{
"name": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640",
"refsource": "CONFIRM",
"url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
},
{
"name": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50",
"refsource": "CONFIRM",
"url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=839158",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-3867",
"datePublished": "2012-08-06T16:00:00",
"dateReserved": "2012-07-06T00:00:00",
"dateUpdated": "2024-08-06T20:21:04.014Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1054 (GCVE-0-2012-1054)
Vulnerability from cvelistv5
Published
2012-05-29 20:00
Modified
2024-08-06 18:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:27.072Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "48157",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48157"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"name": "48166",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48166"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/12460"
},
{
"name": "79496",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/79496"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
},
{
"name": "USN-1372-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"name": "48290",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48290"
},
{
"name": "48161",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48161"
},
{
"name": "SUSE-SU-2012:0325",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"name": "52158",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52158"
},
{
"name": "DSA-2419",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"name": "puppet-k5login-type-symlink(73446)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-02-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "48157",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48157"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"name": "48166",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48166"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/12460"
},
{
"name": "79496",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/79496"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
},
{
"name": "USN-1372-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"name": "48290",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48290"
},
{
"name": "48161",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48161"
},
{
"name": "SUSE-SU-2012:0325",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"name": "52158",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52158"
},
{
"name": "DSA-2419",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"name": "puppet-k5login-type-symlink(73446)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1054",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "48157",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48157"
},
{
"name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14",
"refsource": "CONFIRM",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"name": "48166",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48166"
},
{
"name": "http://projects.puppetlabs.com/issues/12460",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/12460"
},
{
"name": "79496",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/79496"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-1054/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
},
{
"name": "USN-1372-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"name": "48290",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48290"
},
{
"name": "48161",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48161"
},
{
"name": "SUSE-SU-2012:0325",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"name": "52158",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52158"
},
{
"name": "DSA-2419",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"name": "puppet-k5login-type-symlink(73446)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
},
{
"name": "openSUSE-SU-2012:0835",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/15087408"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1054",
"datePublished": "2012-05-29T20:00:00",
"dateReserved": "2012-02-13T00:00:00",
"dateUpdated": "2024-08-06T18:45:27.072Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1986 (GCVE-0-2012-1986)
Vulnerability from cvelistv5
Published
2012-05-29 20:00
Modified
2024-08-06 19:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.
References
| ► | URL | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:27.701Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "FEDORA-2012-5999",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
},
{
"name": "openSUSE-SU-2012:0608",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"name": "puppet-rest-symlink(74794)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48743"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"name": "FEDORA-2012-6055",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"name": "FEDORA-2012-6674",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/13511"
},
{
"name": "49136",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/49136"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"name": "48789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48789"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-04-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "FEDORA-2012-5999",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
},
{
"name": "openSUSE-SU-2012:0608",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"name": "puppet-rest-symlink(74794)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48743"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"name": "FEDORA-2012-6055",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"name": "FEDORA-2012-6674",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/13511"
},
{
"name": "49136",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/49136"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"name": "48789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48789"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1986",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "USN-1419-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "FEDORA-2012-5999",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-1986/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
},
{
"name": "openSUSE-SU-2012:0608",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"name": "puppet-rest-symlink(74794)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"name": "48743",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48743"
},
{
"name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15",
"refsource": "CONFIRM",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"name": "FEDORA-2012-6055",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"name": "FEDORA-2012-6674",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"name": "http://projects.puppetlabs.com/issues/13511",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/13511"
},
{
"name": "49136",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/49136"
},
{
"name": "52975",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"name": "openSUSE-SU-2012:0835",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"name": "48789",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48789"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1986",
"datePublished": "2012-05-29T20:00:00",
"dateReserved": "2012-04-02T00:00:00",
"dateUpdated": "2024-08-06T19:17:27.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3870 (GCVE-0-2011-3870)
Vulnerability from cvelistv5
Published
2011-10-27 20:00
Modified
2024-08-06 23:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:31.428Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2011-13633",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2011-3870"
},
{
"name": "FEDORA-2011-13623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46458"
},
{
"name": "FEDORA-2011-13636",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1223-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2011-13633",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2011-3870"
},
{
"name": "FEDORA-2011-13623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46458"
},
{
"name": "FEDORA-2011-13636",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1223-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3870",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2011-13633",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"name": "https://puppet.com/security/cve/cve-2011-3870",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2011-3870"
},
{
"name": "FEDORA-2011-13623",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46458"
},
{
"name": "FEDORA-2011-13636",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"name": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb",
"refsource": "CONFIRM",
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3870",
"datePublished": "2011-10-27T20:00:00",
"dateReserved": "2011-09-29T00:00:00",
"dateUpdated": "2024-08-06T23:53:31.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-3864 (GCVE-0-2012-3864)
Vulnerability from cvelistv5
Published
2012-08-06 16:00
Modified
2024-08-06 20:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:21:04.064Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2012:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50014"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-07-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-08T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2012:0983",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50014"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-3864",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2012:0983",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-3864/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
},
{
"name": "DSA-2511",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50014"
},
{
"name": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4",
"refsource": "CONFIRM",
"url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
},
{
"name": "openSUSE-SU-2012:0891",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=839130",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
},
{
"name": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87",
"refsource": "CONFIRM",
"url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-3864",
"datePublished": "2012-08-06T16:00:00",
"dateReserved": "2012-07-06T00:00:00",
"dateUpdated": "2024-08-06T20:21:04.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-1652 (GCVE-0-2013-1652)
Vulnerability from cvelistv5
Published
2013-03-20 16:00
Modified
2024-08-06 15:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:13:31.710Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "58443",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/58443"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1652/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master\u0027s cache via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-04-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "58443",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/58443"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1652/"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1652",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master\u0027s cache via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2013:0618",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "58443",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/58443"
},
{
"name": "52596",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-1652/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-1652/"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1652",
"datePublished": "2013-03-20T16:00:00",
"dateReserved": "2013-02-11T00:00:00",
"dateUpdated": "2024-08-06T15:13:31.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1053 (GCVE-0-2012-1053)
Vulnerability from cvelistv5
Published
2012-05-29 20:00
Modified
2024-08-06 18:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
References
| ► | URL | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:45:26.804Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "48157",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48157"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"name": "48166",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48166"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/12458"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/12459"
},
{
"name": "USN-1372-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"name": "48290",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48290"
},
{
"name": "79495",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/79495"
},
{
"name": "48161",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48161"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/12457"
},
{
"name": "SUSE-SU-2012:0325",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"name": "puppet-forked-priv-escalation(73445)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
},
{
"name": "52158",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52158"
},
{
"name": "DSA-2419",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-02-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "48157",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48157"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"name": "48166",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48166"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/12458"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/12459"
},
{
"name": "USN-1372-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"name": "48290",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48290"
},
{
"name": "79495",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/79495"
},
{
"name": "48161",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48161"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/12457"
},
{
"name": "SUSE-SU-2012:0325",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"name": "puppet-forked-priv-escalation(73445)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
},
{
"name": "52158",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52158"
},
{
"name": "DSA-2419",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1053",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "48157",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48157"
},
{
"name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14",
"refsource": "CONFIRM",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"name": "48166",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48166"
},
{
"name": "http://projects.puppetlabs.com/issues/12458",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/12458"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-1053/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
},
{
"name": "http://projects.puppetlabs.com/issues/12459",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/12459"
},
{
"name": "USN-1372-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"name": "48290",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48290"
},
{
"name": "79495",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/79495"
},
{
"name": "48161",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48161"
},
{
"name": "http://projects.puppetlabs.com/issues/12457",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/12457"
},
{
"name": "SUSE-SU-2012:0325",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"name": "puppet-forked-priv-escalation(73445)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
},
{
"name": "52158",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52158"
},
{
"name": "DSA-2419",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"name": "openSUSE-SU-2012:0835",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/15087408"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1053",
"datePublished": "2012-05-29T20:00:00",
"dateReserved": "2012-02-13T00:00:00",
"dateUpdated": "2024-08-06T18:45:26.804Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1987 (GCVE-0-2012-1987)
Vulnerability from cvelistv5
Published
2012-05-29 20:00
Modified
2024-08-06 19:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.
References
| ► | URL | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:27.604Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "puppet-rest-dos(74795)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/13552"
},
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "FEDORA-2012-5999",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"name": "openSUSE-SU-2012:0608",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48743"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"name": "FEDORA-2012-6055",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"name": "FEDORA-2012-6674",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"name": "49136",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/49136"
},
{
"name": "81308",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/81308"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/13553"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"name": "48789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48789"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-04-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "puppet-rest-dos(74795)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/13552"
},
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "FEDORA-2012-5999",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"name": "openSUSE-SU-2012:0608",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48743"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"name": "FEDORA-2012-6055",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"name": "FEDORA-2012-6674",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"name": "49136",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/49136"
},
{
"name": "81308",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/81308"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/13553"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"name": "48789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48789"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1987",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "puppet-rest-dos(74795)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-1987/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
},
{
"name": "http://projects.puppetlabs.com/issues/13552",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/13552"
},
{
"name": "USN-1419-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "FEDORA-2012-5999",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"name": "openSUSE-SU-2012:0608",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"name": "48743",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48743"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
},
{
"name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15",
"refsource": "CONFIRM",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"name": "FEDORA-2012-6055",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"name": "FEDORA-2012-6674",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"name": "49136",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/49136"
},
{
"name": "81308",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/81308"
},
{
"name": "52975",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"name": "http://projects.puppetlabs.com/issues/13553",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/13553"
},
{
"name": "openSUSE-SU-2012:0835",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"name": "48789",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48789"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1987",
"datePublished": "2012-05-29T20:00:00",
"dateReserved": "2012-04-02T00:00:00",
"dateUpdated": "2024-08-06T19:17:27.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1989 (GCVE-0-2012-1989)
Vulnerability from cvelistv5
Published
2012-06-27 18:00
Modified
2024-08-06 19:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
References
| ► | URL | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:27.600Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/13606"
},
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1989/"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48743"
},
{
"name": "puppet-nettelnet-symlink(74797)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74797"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13"
},
{
"name": "49136",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/49136"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "openSUSE-SU-2012:0608",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-04-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log)."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/13606"
},
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1989/"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48743"
},
{
"name": "puppet-nettelnet-symlink(74797)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74797"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13"
},
{
"name": "49136",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/49136"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "openSUSE-SU-2012:0608",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "openSUSE-SU-2012:0835",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1989",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log)."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://projects.puppetlabs.com/issues/13606",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/13606"
},
{
"name": "USN-1419-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-1989/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-1989/"
},
{
"name": "48743",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48743"
},
{
"name": "puppet-nettelnet-symlink(74797)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74797"
},
{
"name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13",
"refsource": "CONFIRM",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13"
},
{
"name": "49136",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/49136"
},
{
"name": "52975",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "openSUSE-SU-2012:0608",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html"
},
{
"name": "48748",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48748"
},
{
"name": "openSUSE-SU-2012:0835",
"refsource": "SUSE",
"url": "https://hermes.opensuse.org/messages/15087408"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1989",
"datePublished": "2012-06-27T18:00:00",
"dateReserved": "2012-04-02T00:00:00",
"dateUpdated": "2024-08-06T19:17:27.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3848 (GCVE-0-2011-3848)
Vulnerability from cvelistv5
Published
2011-10-27 20:00
Modified
2024-08-06 23:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25.
References
| ► | URL | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:46:03.204Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "openSUSE-SU-2011:1190",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2011-3848"
},
{
"name": "USN-1217-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1217-1"
},
{
"name": "46628",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46628"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "openSUSE-SU-2011:1190",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2011-3848"
},
{
"name": "USN-1217-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1217-1"
},
{
"name": "46628",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46628"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3848",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-2314",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "openSUSE-SU-2011:1190",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html"
},
{
"name": "https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406",
"refsource": "CONFIRM",
"url": "https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406"
},
{
"name": "https://puppet.com/security/cve/cve-2011-3848",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2011-3848"
},
{
"name": "USN-1217-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1217-1"
},
{
"name": "46628",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46628"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3848",
"datePublished": "2011-10-27T20:00:00",
"dateReserved": "2011-09-27T00:00:00",
"dateUpdated": "2024-08-06T23:46:03.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-2275 (GCVE-0-2013-2275)
Vulnerability from cvelistv5
Published
2013-03-20 16:00
Modified
2024-08-06 15:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:27:41.177Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2275/"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"name": "58449",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/58449"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-04-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2275/"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"name": "58449",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/58449"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-2275",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2013:0618",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-2275/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-2275/"
},
{
"name": "52596",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"name": "58449",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/58449"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-2275",
"datePublished": "2013-03-20T16:00:00",
"dateReserved": "2013-02-26T00:00:00",
"dateUpdated": "2024-08-06T15:27:41.177Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3872 (GCVE-0-2011-3872)
Vulnerability from cvelistv5
Published
2011-10-27 20:00
Modified
2024-08-06 23:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."
References
| ► | URL | Tags | |||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:31.429Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "46550",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46550"
},
{
"name": "USN-1238-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1238-2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
},
{
"name": "puppet-x509-spoofing(70970)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
},
{
"name": "46578",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46578"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2011-3872"
},
{
"name": "46934",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46934"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
},
{
"name": "50356",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/50356"
},
{
"name": "46964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46964"
},
{
"name": "USN-1238-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1238-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-10-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master\u0027s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka \"AltNames Vulnerability.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "46550",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46550"
},
{
"name": "USN-1238-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1238-2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
},
{
"name": "puppet-x509-spoofing(70970)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
},
{
"name": "46578",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46578"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2011-3872"
},
{
"name": "46934",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46934"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
},
{
"name": "50356",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/50356"
},
{
"name": "46964",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46964"
},
{
"name": "USN-1238-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1238-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3872",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master\u0027s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka \"AltNames Vulnerability.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "46550",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46550"
},
{
"name": "USN-1238-2",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1238-2"
},
{
"name": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
},
{
"name": "puppet-x509-spoofing(70970)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
},
{
"name": "46578",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46578"
},
{
"name": "https://puppet.com/security/cve/cve-2011-3872",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2011-3872"
},
{
"name": "46934",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46934"
},
{
"name": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1",
"refsource": "CONFIRM",
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
},
{
"name": "50356",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/50356"
},
{
"name": "46964",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46964"
},
{
"name": "USN-1238-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1238-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3872",
"datePublished": "2011-10-27T20:00:00",
"dateReserved": "2011-09-29T00:00:00",
"dateUpdated": "2024-08-06T23:53:31.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-1398 (GCVE-0-2013-1398)
Vulnerability from cvelistv5
Published
2014-03-14 16:00
Modified
2024-08-06 14:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:57:05.151Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-1398"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-02-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-14T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-1398"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1398",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://puppetlabs.com/security/cve/cve-2013-1398",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2013-1398"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1398",
"datePublished": "2014-03-14T16:00:00",
"dateReserved": "2013-01-17T00:00:00",
"dateUpdated": "2024-08-06T14:57:05.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1906 (GCVE-0-2012-1906)
Vulnerability from cvelistv5
Published
2012-05-29 20:00
Modified
2024-08-06 19:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:27.063Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://projects.puppetlabs.com/issues/13260"
},
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48743"
},
{
"name": "puppet-macosx-symlink(74793)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"name": "48789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/48789"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-04-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://projects.puppetlabs.com/issues/13260"
},
{
"name": "USN-1419-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "48743",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48743"
},
{
"name": "puppet-macosx-symlink(74793)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
},
{
"name": "52975",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"name": "48789",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/48789"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1906",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://projects.puppetlabs.com/issues/13260",
"refsource": "MISC",
"url": "http://projects.puppetlabs.com/issues/13260"
},
{
"name": "USN-1419-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"name": "48743",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48743"
},
{
"name": "puppet-macosx-symlink(74793)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-1906/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
},
{
"name": "52975",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"name": "48748",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48748"
},
{
"name": "DSA-2451",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"name": "48789",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/48789"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1906",
"datePublished": "2012-05-29T20:00:00",
"dateReserved": "2012-03-26T00:00:00",
"dateUpdated": "2024-08-06T19:17:27.063Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3869 (GCVE-0-2011-3869)
Vulnerability from cvelistv5
Published
2011-10-27 20:00
Modified
2024-08-06 23:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:31.193Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2011-13633",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"name": "FEDORA-2011-13623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46458"
},
{
"name": "FEDORA-2011-13636",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2011-3869"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2011-13633",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"name": "FEDORA-2011-13623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46458"
},
{
"name": "FEDORA-2011-13636",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2011-3869"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3869",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2011-13633",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"name": "FEDORA-2011-13623",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46458"
},
{
"name": "FEDORA-2011-13636",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"name": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb",
"refsource": "CONFIRM",
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"name": "https://puppet.com/security/cve/cve-2011-3869",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2011-3869"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3869",
"datePublished": "2011-10-27T20:00:00",
"dateReserved": "2011-09-29T00:00:00",
"dateUpdated": "2024-08-06T23:53:31.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-1654 (GCVE-0-2013-1654)
Vulnerability from cvelistv5
Published
2013-03-20 16:00
Modified
2024-08-06 15:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:13:32.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1654/"
},
{
"name": "64758",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64758"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-01-16T01:57:02",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1654/"
},
{
"name": "64758",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64758"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1654",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2013:0618",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "52596",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-1654/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-1654/"
},
{
"name": "64758",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/64758"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1654",
"datePublished": "2013-03-20T16:00:00",
"dateReserved": "2013-02-11T00:00:00",
"dateUpdated": "2024-08-06T15:13:32.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-1653 (GCVE-0-2013-1653)
Vulnerability from cvelistv5
Published
2013-03-20 16:00
Modified
2024-08-06 15:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:13:32.279Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "58446",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/58446"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1653/"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the \"run\" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-04-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "58446",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/58446"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1653/"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1653",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the \"run\" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2013:0618",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "58446",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/58446"
},
{
"name": "DSA-2643",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-1653/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-1653/"
},
{
"name": "52596",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/52596"
},
{
"name": "USN-1759-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1653",
"datePublished": "2013-03-20T16:00:00",
"dateReserved": "2013-02-11T00:00:00",
"dateUpdated": "2024-08-06T15:13:32.279Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4956 (GCVE-0-2013-4956)
Vulnerability from cvelistv5
Published
2013-08-20 22:00
Modified
2024-08-06 16:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.
References
| ► | URL | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:40.991Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-2761",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4956/"
},
{
"name": "RHSA-2013:1284",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-09-25T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-2761",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4956/"
},
{
"name": "RHSA-2013:1284",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4956",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-2761",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2013-4956/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2013-4956/"
},
{
"name": "RHSA-2013:1284",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4956",
"datePublished": "2013-08-20T22:00:00",
"dateReserved": "2013-07-29T00:00:00",
"dateUpdated": "2024-08-06T16:59:40.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-3871 (GCVE-0-2011-3871)
Vulnerability from cvelistv5
Published
2011-10-27 20:00
Modified
2024-08-06 23:53
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
References
| ► | URL | Tags | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:53:31.193Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "FEDORA-2011-13633",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"name": "FEDORA-2011-13623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46458"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2011-3871"
},
{
"name": "FEDORA-2011-13636",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1223-2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-09-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "FEDORA-2011-13633",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"name": "FEDORA-2011-13623",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46458"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2011-3871"
},
{
"name": "FEDORA-2011-13636",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1223-2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3871",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "FEDORA-2011-13633",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"name": "FEDORA-2011-13623",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"name": "DSA-2314",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"name": "46458",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46458"
},
{
"name": "https://puppet.com/security/cve/cve-2011-3871",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2011-3871"
},
{
"name": "FEDORA-2011-13636",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"name": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb",
"refsource": "CONFIRM",
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"name": "USN-1223-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"name": "USN-1223-2",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3871",
"datePublished": "2011-10-27T20:00:00",
"dateReserved": "2011-09-29T00:00:00",
"dateUpdated": "2024-08-06T23:53:31.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4969 (GCVE-0-2013-4969)
Vulnerability from cvelistv5
Published
2014-01-07 18:00
Modified
2024-08-06 16:59
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:59:41.037Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-2831",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2831"
},
{
"name": "56254",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56254"
},
{
"name": "56253",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56253"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4969"
},
{
"name": "USN-2077-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2077-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-12-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-01-16T18:57:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-2831",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2831"
},
{
"name": "56254",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56254"
},
{
"name": "56253",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56253"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4969"
},
{
"name": "USN-2077-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2077-1"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4969",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-2831",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2831"
},
{
"name": "56254",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56254"
},
{
"name": "56253",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56253"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2013-4969",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2013-4969"
},
{
"name": "USN-2077-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2077-1"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4969",
"datePublished": "2014-01-07T18:00:00",
"dateReserved": "2013-07-29T00:00:00",
"dateUpdated": "2024-08-06T16:59:41.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-1399 (GCVE-0-2013-1399)
Vulnerability from cvelistv5
Published
2014-03-14 16:00
Modified
2024-08-06 14:57
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:57:05.138Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1399"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-02-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-14T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1399"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1399",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://puppetlabs.com/security/cve/cve-2013-1399",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-1399"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1399",
"datePublished": "2014-03-14T16:00:00",
"dateReserved": "2013-01-17T00:00:00",
"dateUpdated": "2024-08-06T14:57:05.138Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-2274 (GCVE-0-2013-2274)
Vulnerability from cvelistv5
Published
2013-03-20 16:00
Modified
2024-08-06 15:27
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:27:41.143Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "58447",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/58447"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2274/"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-04-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "58447",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/58447"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2274/"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52596"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-2274",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "SUSE-SU-2013:0618",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "RHSA-2013:0710",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"name": "DSA-2643",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "58447",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/58447"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-2274/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-2274/"
},
{
"name": "52596",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/52596"
},
{
"name": "openSUSE-SU-2013:0641",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-2274",
"datePublished": "2013-03-20T16:00:00",
"dateReserved": "2013-02-26T00:00:00",
"dateUpdated": "2024-08-06T15:27:41.143Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-5158 (GCVE-0-2012-5158)
Vulnerability from cvelistv5
Published
2014-03-14 16:00
Modified
2024-08-06 20:58
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:58:02.825Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-5158"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-10-10T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-14T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-5158"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-5158",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://puppetlabs.com/security/cve/cve-2012-5158",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-5158"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-5158",
"datePublished": "2014-03-14T16:00:00",
"dateReserved": "2012-09-25T00:00:00",
"dateUpdated": "2024-08-06T20:58:02.825Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-3866 (GCVE-0-2012-3866)
Vulnerability from cvelistv5
Published
2012-08-06 16:00
Modified
2024-08-06 20:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:21:03.900Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3866/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839135"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-07-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-08T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f"
},
{
"name": "DSA-2511",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3866/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839135"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-3866",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f",
"refsource": "CONFIRM",
"url": "https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f"
},
{
"name": "DSA-2511",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"name": "USN-1506-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"name": "50014",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50014"
},
{
"name": "openSUSE-SU-2012:0891",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2012-3866/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2012-3866/"
},
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=839135",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839135"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-3866",
"datePublished": "2012-08-06T16:00:00",
"dateReserved": "2012-07-06T00:00:00",
"dateUpdated": "2024-08-06T20:21:03.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-3567 (GCVE-0-2013-3567)
Vulnerability from cvelistv5
Published
2013-08-19 23:00
Modified
2024-08-06 16:14
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
References
| ► | URL | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:14:56.276Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "54429",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/54429"
},
{
"name": "SUSE-SU-2013:1304",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html"
},
{
"name": "openSUSE-SU-2013:1370",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html"
},
{
"name": "DSA-2715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2715"
},
{
"name": "USN-1886-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1886-1"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-3567/"
},
{
"name": "RHSA-2013:1284",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-06-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-30T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "54429",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/54429"
},
{
"name": "SUSE-SU-2013:1304",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html"
},
{
"name": "openSUSE-SU-2013:1370",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html"
},
{
"name": "DSA-2715",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2715"
},
{
"name": "USN-1886-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1886-1"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-3567/"
},
{
"name": "RHSA-2013:1284",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-3567",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "54429",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/54429"
},
{
"name": "SUSE-SU-2013:1304",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html"
},
{
"name": "openSUSE-SU-2013:1370",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html"
},
{
"name": "DSA-2715",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2715"
},
{
"name": "USN-1886-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-1886-1"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-3567/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-3567/"
},
{
"name": "RHSA-2013:1284",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-3567",
"datePublished": "2013-08-19T23:00:00",
"dateReserved": "2013-05-21T00:00:00",
"dateUpdated": "2024-08-06T16:14:56.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-1655 (GCVE-0-2013-1655)
Vulnerability from cvelistv5
Published
2013-03-20 16:00
Modified
2024-08-06 15:13
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
References
| ► | URL | Tags | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:13:31.295Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "58442",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/58442"
},
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52596"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1655/"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-03-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to \"serialized attributes.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-04-11T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "58442",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/58442"
},
{
"name": "SUSE-SU-2013:0618",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "DSA-2643",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "52596",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52596"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1655/"
},
{
"name": "USN-1759-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-1655",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to \"serialized attributes.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "58442",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/58442"
},
{
"name": "SUSE-SU-2013:0618",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"name": "DSA-2643",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"name": "52596",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/52596"
},
{
"name": "https://puppetlabs.com/security/cve/cve-2013-1655/",
"refsource": "CONFIRM",
"url": "https://puppetlabs.com/security/cve/cve-2013-1655/"
},
{
"name": "USN-1759-1",
"refsource": "UBUNTU",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"name": "openSUSE-SU-2013:0641",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-1655",
"datePublished": "2013-03-20T16:00:00",
"dateReserved": "2013-02-11T00:00:00",
"dateUpdated": "2024-08-06T15:13:31.295Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-4761 (GCVE-0-2013-4761)
Vulnerability from cvelistv5
Published
2013-08-20 22:00
Modified
2024-08-06 16:52
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
References
| ► | URL | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:52:26.979Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-2761",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"name": "SUSE-SU-2014:0155",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4761/"
},
{
"name": "RHSA-2013:1284",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-02-26T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "DSA-2761",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"name": "SUSE-SU-2014:0155",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4761/"
},
{
"name": "RHSA-2013:1284",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-4761",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "DSA-2761",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"name": "SUSE-SU-2014:0155",
"refsource": "SUSE",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html"
},
{
"name": "http://puppetlabs.com/security/cve/cve-2013-4761/",
"refsource": "CONFIRM",
"url": "http://puppetlabs.com/security/cve/cve-2013-4761/"
},
{
"name": "RHSA-2013:1284",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"name": "RHSA-2013:1283",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-4761",
"datePublished": "2013-08-20T22:00:00",
"dateReserved": "2013-07-05T00:00:00",
"dateUpdated": "2024-08-06T16:52:26.979Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2012-05-29 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html | ||
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html | ||
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html | ||
| cve@mitre.org | http://projects.puppetlabs.com/issues/13552 | Vendor Advisory | |
| cve@mitre.org | http://projects.puppetlabs.com/issues/13553 | Vendor Advisory | |
| cve@mitre.org | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-1987/ | Vendor Advisory | |
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/ | ||
| cve@mitre.org | http://secunia.com/advisories/48743 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48748 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48789 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/49136 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1419-1 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2451 | ||
| cve@mitre.org | http://www.osvdb.org/81308 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/52975 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 | ||
| cve@mitre.org | https://hermes.opensuse.org/messages/14523305 | ||
| cve@mitre.org | https://hermes.opensuse.org/messages/15087408 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/13552 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/13553 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-1987/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48743 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48748 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48789 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/49136 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1419-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2451 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/81308 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/52975 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://hermes.opensuse.org/messages/14523305 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://hermes.opensuse.org/messages/15087408 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet_enterprise | 2.5.0 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 1.2.1 | |
| puppet | puppet_enterprise | 1.2.2 | |
| puppet | puppet_enterprise | 1.2.3 | |
| puppet | puppet_enterprise | 1.2.4 | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.0.1 | |
| puppet | puppet_enterprise | 2.0.2 | |
| puppetlabs | puppet_enterprise_users | 1.0 | |
| puppetlabs | puppet_enterprise_users | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB5A3CC-05AA-4192-9527-7B55FC1121F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BFF8F62F-8782-4FD2-BC14-3F9E46881F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "36A3FDB9-F599-4999-A6B9-C82C7DAF5A70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "41C07E3C-4F96-4B91-8B2D-09076749FF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "76BD798A-9D06-4CC2-B40B-D377EBEBA5B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1389B834-FE5B-4CF7-93CC-63E919FC58CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8A8C568-1922-4701-BA61-DF960C43A6FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C1C09E3-88DB-4022-B4B4-8FEE5D9CB57B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5ED72A-0C75-4680-8283-E0AE47780B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations."
},
{
"lang": "es",
"value": "Vulnerabilidad no especificada en Puppet v2.6.x anterior a v2.6.15 y v2.7.x anterior a v2.7.13, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x, y v2.5.x anterior a v2.5.1 permite a usuarios remotos autenticados con el agente de claves SSL (1) provocar una denegaci\u00f3n de servicio (consumo de memoria) a trav\u00e9s de una petici\u00f3n REST como se demuestra con CVE-2012-1986 and /dev/random, o (2) provocar una denegaci\u00f3n de servicio (consumo del sistema de fichero) a trav\u00e9s de peticiones REST manipuladas que utilizan un objeto Puppet::FileBucket::File para escribir en las ubicaciones de archivos arbitrarios."
}
],
"id": "CVE-2012-1987",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-05-29T20:55:07.603",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/13552"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/13553"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
},
{
"source": "cve@mitre.org",
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48789"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/49136"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/81308"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/13552"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/13553"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48789"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/49136"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/81308"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-10-27 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html | ||
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html | Patch | |
| cve@mitre.org | http://secunia.com/advisories/46458 | Vendor Advisory | |
| cve@mitre.org | http://www.debian.org/security/2011/dsa-2314 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1223-1 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1223-2 | ||
| cve@mitre.org | https://puppet.com/security/cve/cve-2011-3869 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46458 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2011/dsa-2314 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1223-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1223-2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppet.com/security/cve/cve-2011-3869 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet | 0.25.0 | |
| puppet | puppet | 0.25.1 | |
| puppet | puppet | 0.25.2 | |
| puppet | puppet | 0.25.3 | |
| puppet | puppet | 0.25.4 | |
| puppet | puppet | 0.25.5 | |
| puppet | puppet | 0.25.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*",
"matchCriteriaId": "52C34E71-CDCA-469E-85FD-316010553708",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF3FF502-48C2-4836-8CBD-BBD82635D1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D216DB81-4AB7-4379-B5C8-443498B06997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BD9F3846-FAFC-41BE-A11E-3F80D4275E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.4:*:*:*:*:*:*:*",
"matchCriteriaId": "112BCA2E-4CF6-46DC-AD2A-1BF4C26AD7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C34ACEB4-7C4A-47BA-AD78-0B453BB20983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.6:*:*:*:*:*:*:*",
"matchCriteriaId": "90409589-D825-4CA3-9984-15DFC0FF20CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file."
},
{
"lang": "es",
"value": "Puppet v2.7.x anterior a v2.7.5, v2.6.x anterior a v2.6.11, y v0.25.x permite a usuarios locales sobreescribir ficheros arbitrarios mediante un enlace simb\u00f3lico sobre el fichero .k5login."
}
],
"id": "CVE-2011-3869",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.3,
"confidentialityImpact": "NONE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 9.2,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-10-27T20:55:01.417",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46458"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"source": "cve@mitre.org",
"url": "https://puppet.com/security/cve/cve-2011-3869"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46458"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2011-3869"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-10-27 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html | Patch | |
| cve@mitre.org | http://secunia.com/advisories/46458 | Vendor Advisory | |
| cve@mitre.org | http://www.debian.org/security/2011/dsa-2314 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1223-1 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1223-2 | ||
| cve@mitre.org | https://puppet.com/security/cve/cve-2011-3871 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46458 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2011/dsa-2314 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1223-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1223-2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppet.com/security/cve/cve-2011-3871 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet | 0.25.0 | |
| puppet | puppet | 0.25.1 | |
| puppet | puppet | 0.25.2 | |
| puppet | puppet | 0.25.3 | |
| puppet | puppet | 0.25.4 | |
| puppet | puppet | 0.25.5 | |
| puppet | puppet | 0.25.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*",
"matchCriteriaId": "52C34E71-CDCA-469E-85FD-316010553708",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF3FF502-48C2-4836-8CBD-BBD82635D1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D216DB81-4AB7-4379-B5C8-443498B06997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BD9F3846-FAFC-41BE-A11E-3F80D4275E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.4:*:*:*:*:*:*:*",
"matchCriteriaId": "112BCA2E-4CF6-46DC-AD2A-1BF4C26AD7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C34ACEB4-7C4A-47BA-AD78-0B453BB20983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.6:*:*:*:*:*:*:*",
"matchCriteriaId": "90409589-D825-4CA3-9984-15DFC0FF20CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files."
},
{
"lang": "es",
"value": "Puppet v2.7.x anterior a v2.7.5, v2.6.x anterior a v2.6.11, y v0.25.x, cuando se ejecuta el modo --edit, usa un nombre de fichero predecible, permitiendo a usuarios locales ejecutar c\u00f3digo Puppet arbitrario o enga\u00f1ando a un usuario a editar ficheros arbitarios"
}
],
"id": "CVE-2011-3871",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.2,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 1.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-10-27T20:55:01.620",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46458"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"source": "cve@mitre.org",
"url": "https://puppet.com/security/cve/cve-2011-3871"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46458"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2011-3871"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-10-27 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1 | Patch | |
| cve@mitre.org | http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/ | ||
| cve@mitre.org | http://secunia.com/advisories/46550 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/46578 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/46934 | ||
| cve@mitre.org | http://secunia.com/advisories/46964 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/50356 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1238-1 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1238-2 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/70970 | ||
| cve@mitre.org | https://puppet.com/security/cve/cve-2011-3872 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46550 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46578 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46934 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46964 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/50356 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1238-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1238-2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/70970 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppet.com/security/cve/cve-2011-3872 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 1.2.1 | |
| puppet | puppet_enterprise | 1.2.2 | |
| puppet | puppet_enterprise | 1.2.3 | |
| puppetlabs | puppet_enterprise_users | 1.0 | |
| puppetlabs | puppet_enterprise_users | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BFF8F62F-8782-4FD2-BC14-3F9E46881F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "36A3FDB9-F599-4999-A6B9-C82C7DAF5A70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "41C07E3C-4F96-4B91-8B2D-09076749FF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C1C09E3-88DB-4022-B4B4-8FEE5D9CB57B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5ED72A-0C75-4680-8283-E0AE47780B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master\u0027s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka \"AltNames Vulnerability.\""
},
{
"lang": "es",
"value": "Puppet v2.6.x antes de v2.6.12 y v2.7.x antes de v2.7.6, y Puppet Enterprise (PE) Users v1.0, v1.1, y v1.2 antes de v1.2.4, al firmar un certificado de agente, a\u00f1ade los valores de Puppet master\u0027s certdnsnames al campo X.509 Subject Alternative Name, lo que permite a atacantes remotos falsificar un Puppet master a trav\u00e9s de un ataque \"Man-in-the-middle\" contra un agente que utilice un nombre alternativo de DNS para el maestro, tambi\u00e9n conocido como \"Vulnerabilidad AltNames.\""
}
],
"id": "CVE-2011-3872",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-10-27T20:55:01.760",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
},
{
"source": "cve@mitre.org",
"url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46550"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46578"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/46934"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/46964"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/50356"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1238-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1238-2"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
},
{
"source": "cve@mitre.org",
"url": "https://puppet.com/security/cve/cve-2011-3872"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46550"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46578"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/46934"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/46964"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/50356"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1238-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1238-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2011-3872"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-10-27 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html | Patch | |
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html | Patch | |
| cve@mitre.org | http://secunia.com/advisories/46458 | Vendor Advisory | |
| cve@mitre.org | http://www.debian.org/security/2011/dsa-2314 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1223-1 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1223-2 | ||
| cve@mitre.org | https://puppet.com/security/cve/cve-2011-3870 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46458 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2011/dsa-2314 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1223-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1223-2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppet.com/security/cve/cve-2011-3870 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet | 0.25.0 | |
| puppet | puppet | 0.25.1 | |
| puppet | puppet | 0.25.2 | |
| puppet | puppet | 0.25.3 | |
| puppet | puppet | 0.25.4 | |
| puppet | puppet | 0.25.5 | |
| puppet | puppet | 0.25.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.0:*:*:*:*:*:*:*",
"matchCriteriaId": "52C34E71-CDCA-469E-85FD-316010553708",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.1:*:*:*:*:*:*:*",
"matchCriteriaId": "CF3FF502-48C2-4836-8CBD-BBD82635D1A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D216DB81-4AB7-4379-B5C8-443498B06997",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.3:*:*:*:*:*:*:*",
"matchCriteriaId": "BD9F3846-FAFC-41BE-A11E-3F80D4275E7C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.4:*:*:*:*:*:*:*",
"matchCriteriaId": "112BCA2E-4CF6-46DC-AD2A-1BF4C26AD7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.5:*:*:*:*:*:*:*",
"matchCriteriaId": "C34ACEB4-7C4A-47BA-AD78-0B453BB20983",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:0.25.6:*:*:*:*:*:*:*",
"matchCriteriaId": "90409589-D825-4CA3-9984-15DFC0FF20CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file."
},
{
"lang": "es",
"value": "Puppet v2.7.x antes de v2.7.5, v2.6.x antes de v2.6.11, y v0.25.x, permite a usuarios locales modificar los permisos de archivos de su elecci\u00f3n a trav\u00e9s de un ataque symlink al archivo authorized_keys de SSH"
}
],
"id": "CVE-2011-3870",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.3,
"confidentialityImpact": "NONE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 9.2,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-10-27T20:55:01.510",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46458"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"source": "cve@mitre.org",
"url": "https://puppet.com/security/cve/cve-2011-3870"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/91e3b46d2328a1cb"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068053.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068061.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2011-October/068093.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46458"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1223-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1223-2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2011-3870"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-05-29 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html | ||
| cve@mitre.org | http://projects.puppetlabs.com/issues/12457 | ||
| cve@mitre.org | http://projects.puppetlabs.com/issues/12458 | ||
| cve@mitre.org | http://projects.puppetlabs.com/issues/12459 | ||
| cve@mitre.org | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-1053/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48157 | ||
| cve@mitre.org | http://secunia.com/advisories/48161 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48166 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48290 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1372-1 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2419 | ||
| cve@mitre.org | http://www.osvdb.org/79495 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/52158 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/73445 | ||
| cve@mitre.org | https://hermes.opensuse.org/messages/15087408 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/12457 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/12458 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/12459 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-1053/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48157 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48161 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48166 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48290 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1372-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2419 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/79495 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/52158 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/73445 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://hermes.opensuse.org/messages/15087408 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 1.2.1 | |
| puppet | puppet_enterprise | 1.2.2 | |
| puppet | puppet_enterprise | 1.2.3 | |
| puppet | puppet_enterprise | 1.2.4 | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.0.1 | |
| puppet | puppet_enterprise | 2.0.2 | |
| puppetlabs | puppet_enterprise_users | 1.0 | |
| puppetlabs | puppet_enterprise_users | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BFF8F62F-8782-4FD2-BC14-3F9E46881F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "36A3FDB9-F599-4999-A6B9-C82C7DAF5A70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "41C07E3C-4F96-4B91-8B2D-09076749FF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "76BD798A-9D06-4CC2-B40B-D377EBEBA5B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1389B834-FE5B-4CF7-93CC-63E919FC58CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8A8C568-1922-4701-BA61-DF960C43A6FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C1C09E3-88DB-4022-B4B4-8FEE5D9CB57B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5ED72A-0C75-4680-8283-E0AE47780B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups."
},
{
"lang": "es",
"value": "El m\u00e9todo change_user en el SUIDManager SUIDManager (lib/puppet/util/suidmanager.rb) en Puppet v2.6.x anterior a v2.6.14 y v2.7.x anterior a v2.7.11, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x anterior a 2.0.3 no gestiona adecuadamente los privilegios de grupo, lo que permite a usuarios locales conseguir privilegios a trav\u00e9s de vectores relacionados con (1) change_user en ciertas condiciones, (2) cambios en el eguid sin cambios asociados a la egid, o (3) la adici\u00f3n de la gid real a grupos complementarios."
}
],
"id": "CVE-2012-1053",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.9,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-05-29T20:55:07.057",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/issues/12457"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/issues/12458"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/issues/12459"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/48157"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48161"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48166"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48290"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/79495"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52158"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/issues/12457"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/issues/12458"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/issues/12459"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/48157"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48161"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48166"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48290"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/79495"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-03-14 16:55
Modified
2025-04-12 10:46
Severity ?
Summary
Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-5158 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-5158 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet_enterprise | * | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.5.1 | |
| puppet | puppet_enterprise | 2.5.2 | |
| puppetlabs | puppet | 2.5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC8BD854-7A87-4178-B99F-F6E241D79675",
"versionEndIncluding": "2.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32A5E42D-9626-4FC8-A032-4CD4FA1255BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06F0697C-A1BF-42FE-A036-F3E6FAB30A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "27BEF40A-546D-4A5D-8173-A6E3C715B4B9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors."
},
{
"lang": "es",
"value": "Puppet Enterprise (PE) anterior a 2.6.1 no inv\u00e1lida debidamente sesiones cuando el secreto de la sesi\u00f3n ha cambiado, lo que permite a usuarios remotos autenticados retener acceso a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2012-5158",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-03-14T16:55:04.600",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-5158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-5158"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-20 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | Third Party Advisory | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | Third Party Advisory | |
| cve@mitre.org | http://secunia.com/advisories/52596 | Third Party Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1759-1 | Third Party Advisory | |
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2643 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/58446 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-1653/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52596 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1759-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2643 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/58446 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-1653/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | * | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppet | puppet | 2.7.18 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 2.7.19 | |
| puppetlabs | puppet | 2.7.20 | |
| puppetlabs | puppet | 2.7.20 | |
| puppet | puppet_enterprise | 3.1.0 | |
| puppetlabs | puppet | 1.0 | |
| puppetlabs | puppet | 1.1 | |
| puppetlabs | puppet | 1.2.0 | |
| puppetlabs | puppet | 1.2.1 | |
| puppetlabs | puppet | 1.2.2 | |
| puppetlabs | puppet | 1.2.3 | |
| puppetlabs | puppet | 1.2.4 | |
| puppetlabs | puppet | 1.2.5 | |
| puppetlabs | puppet | 1.2.6 | |
| puppet | puppet_enterprise | 2.7.0 | |
| puppet | puppet_enterprise | 2.7.1 | |
| canonical | ubuntu_linux | 11.10 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 12.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1D8BF85B-0874-4FFC-885C-90615BF158F3",
"versionEndIncluding": "2.6.17",
"versionStartIncluding": "2.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*",
"matchCriteriaId": "29BBE8DB-8560-4A57-9BCB-D709A697ECDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*",
"matchCriteriaId": "10E0543B-5B1D-4522-945D-98BD63380500",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*",
"matchCriteriaId": "817AB37A-F7B0-4E68-B10A-9E4A358793F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CFF3B0A-2C66-445A-BB5C-136DCAA584FE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "06B3281A-202F-4FA5-8E8A-110294015624",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.1:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "07659CE1-D808-4A1C-A722-88E1901CA3F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.0:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "7F22BF6C-0463-4D09-BF05-0858D4746339",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.1:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "71A9603C-0E37-4413-88D4-733A803BB4FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.2:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "5563BBE9-AEFA-42BC-801A-AD7C449BF84A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.3:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "A0ACD643-638D-40C6-A66A-EC0D05E2608E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.4:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "38DDC70F-C49B-471B-B7DC-890E39BB7E0D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.5:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "CECE879D-F055-401A-9E8B-0E7620AF357C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.6:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "2F9ACC49-1E6E-4847-8AAA-F3D8E33811E9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3227E6D-27C8-4D6C-A9B7-713558FD9947",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3153F6B2-9CB2-4A1D-834B-33820EC8F0A0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E4174F4F-149E-41A6-BBCC-D01114C05F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the \"run\" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request."
},
{
"lang": "es",
"value": "Puppet anterior a v2.6.18, v2.7.x anterior a v2.7.21, y v3.1.x anterior a v3.1.1, y Puppet Enterprise anterior a v1.2.7 y v2.7.x anterior a v2.7.2, cuando la espera de conexiones entrantes est\u00e1 activado y permiten el acceso al REST \"run\", permiten a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario a trav\u00e9s de un solicitud HTTP especialmente dise\u00f1ada."
}
],
"evaluatorImpact": "per http://www.ubuntu.com/usn/usn-1759-1/\r\n\"A security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n Ubuntu 12.10\r\n Ubuntu 12.04 LTS\r\n Ubuntu 11.10\"",
"id": "CVE-2013-1653",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:H/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-03-20T16:55:01.770",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/58446"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1653/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/58446"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1653/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-10-27 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html | ||
| cve@mitre.org | http://secunia.com/advisories/46628 | Vendor Advisory | |
| cve@mitre.org | http://www.debian.org/security/2011/dsa-2314 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1217-1 | ||
| cve@mitre.org | https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406 | Patch | |
| cve@mitre.org | https://puppet.com/security/cve/cve-2011-3848 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/46628 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2011/dsa-2314 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1217-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406 | Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://puppet.com/security/cve/cve-2011-3848 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en Puppet v2.6.x antes de v2.6.10 y v2.7.x antes de v2.7.4, permite a atacantes remotos escribir Certificate Signing Request (CSR) X.509 en ubicaciones de su elecci\u00f3n a trav\u00e9s de (1) un par\u00e1metro clave de doble codificaci\u00f3n en la URI en v2.7.x, (2) el CN en el Subject de un CSR en v2.6 y v0.25."
}
],
"id": "CVE-2011-3848",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-10-27T20:55:01.230",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46628"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1217-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406"
},
{
"source": "cve@mitre.org",
"url": "https://puppet.com/security/cve/cve-2011-3848"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2011-10/msg00033.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46628"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2011/dsa-2314"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1217-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://groups.google.com/group/puppet-announce/browse_thread/thread/e57ce2740feb9406"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2011-3848"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-05-29 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://projects.puppetlabs.com/issues/13260 | Vendor Advisory | |
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-1906/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48743 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48748 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48789 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1419-1 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2451 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/52975 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/74793 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/13260 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-1906/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48743 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48748 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48789 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1419-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2451 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/52975 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/74793 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet_enterprise | 2.5.0 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 1.2.1 | |
| puppet | puppet_enterprise | 1.2.2 | |
| puppet | puppet_enterprise | 1.2.3 | |
| puppet | puppet_enterprise | 1.2.4 | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.0.1 | |
| puppet | puppet_enterprise | 2.0.2 | |
| puppetlabs | puppet_enterprise_users | 1.0 | |
| puppetlabs | puppet_enterprise_users | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB5A3CC-05AA-4192-9527-7B55FC1121F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BFF8F62F-8782-4FD2-BC14-3F9E46881F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "36A3FDB9-F599-4999-A6B9-C82C7DAF5A70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "41C07E3C-4F96-4B91-8B2D-09076749FF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "76BD798A-9D06-4CC2-B40B-D377EBEBA5B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1389B834-FE5B-4CF7-93CC-63E919FC58CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8A8C568-1922-4701-BA61-DF960C43A6FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C1C09E3-88DB-4022-B4B4-8FEE5D9CB57B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5ED72A-0C75-4680-8283-E0AE47780B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp."
},
{
"lang": "es",
"value": "Puppet v2.6.x anterior a v2.6.15 y v2.7.x anterior a v2.7.13, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x, y v2.5.x anterior a v2.5.1 utiliza nombres de archivos predecibles al instalar paquetes Mac OS X desde una fuente remota, permitiendo a usuarios locales sobreescribir ficheros arbitrarios o instalar paquetes arbitrarios a trav\u00e9s de un ataque de enlace simb\u00f3lico en un archivo temporal en /tmp."
}
],
"id": "CVE-2012-1906",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-05-29T20:55:07.213",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/13260"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48789"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/13260"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48789"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-20 22:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2013-4956/ | Vendor Advisory | |
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-1283.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-1284.html | ||
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2761 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2013-4956/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1283.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1284.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2761 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppet | puppet | 2.7.18 | |
| puppet | puppet | 2.7.21 | |
| puppet | puppet | 2.7.22 | |
| puppet | puppet | 3.2.1 | |
| puppet | puppet | 3.2.2 | |
| puppet | puppet | 3.2.3 | |
| puppet | puppet_enterprise | 2.8.0 | |
| puppet | puppet_enterprise | 2.8.1 | |
| puppet | puppet_enterprise | 2.8.2 | |
| puppet | puppet_enterprise | 3.0.0 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 3.2.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.21:*:*:*:*:*:*:*",
"matchCriteriaId": "31787A8E-ACF2-477A-A101-96C298732631",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.22:*:*:*:*:*:*:*",
"matchCriteriaId": "3E38866A-9724-4E97-9696-E7B90248E587",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "867A327E-421F-46A9-877C-8A2911971E39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "75BA8116-F64D-4CB2-A4DE-B21864962029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B4F1986C-D984-4B90-A790-5D247902AB8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C43CD3C-ACDB-418B-B67D-9C8EFAC0680C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD8F80AD-1E8E-40BE-883D-6F7F61D4A274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9C6E27BB-6444-49E2-8B89-D7E09284D29C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0A2F50-A73B-4598-BE73-1DDA1084352A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12419C96-61A4-46B3-B8DA-FE3B8E7ACAEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions."
},
{
"lang": "es",
"value": "Puppet Module Tool (PMT), usado en Puppet 2.7.x anterior a 2.7.23 y 3.2.x anterior a 3.2.4, y Puppet Enterprise 2.8.x anterior a 2.8.3 y 3.0.x anterior a 3.0.1, instala m\u00f3dulos con permisos d\u00e9biles si estos son utilizados cuando los m\u00f3dulos se construyen inicialmente, lo que podr\u00eda permitir a usuarios locales leer o modificar dichos m\u00f3dulos dependiendo de los permisos originales."
}
],
"id": "CVE-2013-4956",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-20T22:55:04.400",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4956/"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4956/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2761"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-05-29 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html | ||
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html | ||
| cve@mitre.org | http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html | ||
| cve@mitre.org | http://projects.puppetlabs.com/issues/13511 | ||
| cve@mitre.org | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-1986/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48743 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48748 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48789 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/49136 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1419-1 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2451 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/52975 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 | ||
| cve@mitre.org | https://hermes.opensuse.org/messages/14523305 | ||
| cve@mitre.org | https://hermes.opensuse.org/messages/15087408 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/13511 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-1986/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48743 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48748 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48789 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/49136 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1419-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2451 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/52975 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://hermes.opensuse.org/messages/14523305 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://hermes.opensuse.org/messages/15087408 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet_enterprise | 2.5.0 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 1.2.1 | |
| puppet | puppet_enterprise | 1.2.2 | |
| puppet | puppet_enterprise | 1.2.3 | |
| puppet | puppet_enterprise | 1.2.4 | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.0.1 | |
| puppet | puppet_enterprise | 2.0.2 | |
| puppetlabs | puppet_enterprise_users | 1.0 | |
| puppetlabs | puppet_enterprise_users | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB5A3CC-05AA-4192-9527-7B55FC1121F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BFF8F62F-8782-4FD2-BC14-3F9E46881F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "36A3FDB9-F599-4999-A6B9-C82C7DAF5A70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "41C07E3C-4F96-4B91-8B2D-09076749FF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "76BD798A-9D06-4CC2-B40B-D377EBEBA5B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1389B834-FE5B-4CF7-93CC-63E919FC58CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8A8C568-1922-4701-BA61-DF960C43A6FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C1C09E3-88DB-4022-B4B4-8FEE5D9CB57B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5ED72A-0C75-4680-8283-E0AE47780B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
},
{
"lang": "es",
"value": "Puppet v2.6.x anterior a v2.6.15 y v2.7.x anterior a v2.7.13, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x, y v2.5.x anterior a v2.5.1 permite a usuarios remotos autenticados con una clave autorizada SSL y ciertos permisos en el puppet maestro leer archivos arbitrarios a trav\u00e9s de un ataque de enlaces simb\u00f3licos en relaci\u00f3n con una petici\u00f3n REST manipulada para un archivo en un \"filebucket\"."
}
],
"id": "CVE-2012-1986",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-05-29T20:55:07.540",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/issues/13511"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48789"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/49136"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/issues/13511"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48789"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/49136"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2451"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/14523305"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-06 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-3866/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/50014 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2511 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1506-1 | ||
| cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=839135 | ||
| cve@mitre.org | https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-3866/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/50014 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2511 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1506-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=839135 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f | Exploit, Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppetlabs | puppet | * | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A81EA6F-49C7-4883-8F93-E76A60DE1164",
"versionEndIncluding": "2.7.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F66C1E54-FBEA-4008-BC88-A390D415F3F5",
"versionEndIncluding": "2.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file."
},
{
"lang": "es",
"value": "lib/puppet/defaults.rb en Puppet 2.7.x anterior a 2.7.18, y Puppet Enterprise anterior a 2.5.2, emplea permisos del tipo 0644 para last_run_report.yaml, lo que permite a usuarios locales obtener informaci\u00f3n sensible de la configuraci\u00f3n aprovechando el acceso al servidor maestro de Puppet para leer el archivo."
}
],
"id": "CVE-2012-3866",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-08-06T16:55:06.367",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3866/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839135"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3866/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839135"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-06 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://puppetlabs.com/security/cve/cve-2012-3408/ | Vendor Advisory | |
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=839166 | Third Party Advisory | |
| secalert@redhat.com | https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd | Exploit, Patch, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-3408/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=839166 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd | Exploit, Patch, Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet_enterprise | * | |
| puppetlabs | puppet | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "346F9C04-73F0-4244-9086-C16C981C92D1",
"versionEndExcluding": "2.5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "05782A68-DC7C-49D0-847A-F64A5C9F7DDB",
"versionEndExcluding": "2.7.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address."
},
{
"lang": "es",
"value": "lib/puppet/network/authstore.rb en Puppet anterior a v2.7.18, y Puppet Enterprise anterior a v2.5.2, compatible con el uso de direcciones IP en certnames sin previo aviso de los riesgos potenciales, podr\u00edan permitir a atacantes remotos falsificar un agente mediante la adquisici\u00f3n de una direcci\u00f3n IP previamente utilizada."
}
],
"id": "CVE-2012-3408",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-08-06T16:55:05.133",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3408/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839166"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3408/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839166"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-287"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-05-29 20:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html | ||
| cve@mitre.org | http://projects.puppetlabs.com/issues/12460 | Vendor Advisory | |
| cve@mitre.org | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-1054/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48157 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48161 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48166 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48290 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1372-1 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2419 | ||
| cve@mitre.org | http://www.osvdb.org/79496 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/52158 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/73446 | ||
| cve@mitre.org | https://hermes.opensuse.org/messages/15087408 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/12460 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-1054/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48157 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48161 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48166 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48290 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1372-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2419 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/79496 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/52158 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/73446 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://hermes.opensuse.org/messages/15087408 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 1.2.1 | |
| puppet | puppet_enterprise | 1.2.2 | |
| puppet | puppet_enterprise | 1.2.3 | |
| puppet | puppet_enterprise | 1.2.4 | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.0.1 | |
| puppet | puppet_enterprise | 2.0.2 | |
| puppetlabs | puppet_enterprise_users | 1.0 | |
| puppetlabs | puppet_enterprise_users | 1.1 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BFF8F62F-8782-4FD2-BC14-3F9E46881F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "36A3FDB9-F599-4999-A6B9-C82C7DAF5A70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "41C07E3C-4F96-4B91-8B2D-09076749FF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "76BD798A-9D06-4CC2-B40B-D377EBEBA5B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1389B834-FE5B-4CF7-93CC-63E919FC58CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8A8C568-1922-4701-BA61-DF960C43A6FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C1C09E3-88DB-4022-B4B4-8FEE5D9CB57B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "FD5ED72A-0C75-4680-8283-E0AE47780B3E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login."
},
{
"lang": "es",
"value": "Puppet v2.6.x anterior a v2.6.15 y v2.7.x anterior a v2.7.13, y Puppet Enterprise (PE) Users v1.0, v1.1, v1.2.x, v2.0.x anterior a v2.0.3, en la gesti\u00f3n de un archivo de inicio de sesi\u00f3n del usuario con el tipo de recurso k5login, permite a usuarios locales conseguir privilegios a trav\u00e9s de un ataque de enlaces simb\u00f3licos en .k5login."
}
],
"id": "CVE-2012-1054",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-05-29T20:55:07.133",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/12460"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48157"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48161"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48166"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48290"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/79496"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52158"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://projects.puppetlabs.com/issues/12460"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48157"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48161"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48166"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48290"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1372-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2419"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/79496"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-20 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | ||
| cve@mitre.org | http://secunia.com/advisories/52596 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1759-1 | ||
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2643 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/58442 | ||
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-1655/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52596 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1759-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2643 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/58442 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-1655/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppet | puppet | 2.7.18 | |
| puppet | puppet_enterprise | 3.1.0 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 2.7.19 | |
| puppetlabs | puppet | 2.7.20 | |
| puppetlabs | puppet | 2.7.20 | |
| ruby-lang | ruby | 1.9 | |
| ruby-lang | ruby | 1.9.1 | |
| ruby-lang | ruby | 1.9.2 | |
| ruby-lang | ruby | 1.9.3 | |
| ruby-lang | ruby | 1.9.3 | |
| ruby-lang | ruby | 1.9.3 | |
| ruby-lang | ruby | 1.9.3 | |
| ruby-lang | ruby | 1.9.3 | |
| ruby-lang | ruby | 1.9.3 | |
| ruby-lang | ruby | 2.0 | |
| ruby-lang | ruby | 2.0.0 | |
| ruby-lang | ruby | 2.0.0 | |
| ruby-lang | ruby | 2.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CFF3B0A-2C66-445A-BB5C-136DCAA584FE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*",
"matchCriteriaId": "29BBE8DB-8560-4A57-9BCB-D709A697ECDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*",
"matchCriteriaId": "10E0543B-5B1D-4522-945D-98BD63380500",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*",
"matchCriteriaId": "817AB37A-F7B0-4E68-B10A-9E4A358793F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "D9237145-35F8-4E05-B730-77C0F386E5B2",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*",
"matchCriteriaId": "C78BB1D8-0505-484D-B824-1AA219F8B247",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5178D04D-1C29-4353-8987-559AA07443EC",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D0535DC9-EB0E-4745-80AC-4A020DF26E38",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*",
"matchCriteriaId": "94F5AA37-B466-4E2E-B217-5119BADDD87B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*",
"matchCriteriaId": "6DF0F0F5-4022-4837-9B40-4B1127732CC9",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*",
"matchCriteriaId": "B3848B08-85C2-4AAD-AA33-CCEB80EF5B32",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*",
"matchCriteriaId": "B7927D40-2A3A-43AD-99F6-CE61882A1FF4",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*",
"matchCriteriaId": "AA406EC6-6CA5-40A6-A879-AA8940CBEF07",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "90E0471D-1323-4E67-B66C-DEBF3BBAEEAA",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B03B7561-A854-4EFA-9E4E-CFC4EEAE4EE1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "285A3431-BDFE-40C5-92CD-B18217757C23",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "D66B32CB-AC49-4A1C-85ED-6389F27CB319",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to \"serialized attributes.\""
},
{
"lang": "es",
"value": "Puppet v2.7.x anterior a v2.7.21 y 3.1.x anterior a v3.1.1, cuando ejecutan Ruby v1.9.3 o posterior, permite a atacantes remotos ejecutar c\u00f3digo arbitario mediante vectores relacionados con \"serialized attributes.\""
}
],
"evaluatorImpact": "Per http://www.ubuntu.com/usn/usn-1759-1/\r\n\"A security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n Ubuntu 12.10\r\n Ubuntu 12.04 LTS\r\n Ubuntu 11.10\r\n\"",
"id": "CVE-2013-1655",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-03-20T16:55:01.807",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/58442"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1655/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/58442"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1655/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-19 23:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-1283.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-1284.html | ||
| cve@mitre.org | http://secunia.com/advisories/54429 | Vendor Advisory | |
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2715 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1886-1 | ||
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-3567/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1283.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1284.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/54429 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2715 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1886-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-3567/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppet | puppet | 2.7.18 | |
| puppet | puppet | 2.7.21 | |
| puppet | puppet | 3.2.1 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 2.7.19 | |
| puppetlabs | puppet | 2.7.20 | |
| puppetlabs | puppet | 2.7.20 | |
| puppetlabs | puppet | 3.2.0 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 12.10 | |
| canonical | ubuntu_linux | 13.04 | |
| novell | suse_linux_enterprise_desktop | 11 | |
| novell | suse_linux_enterprise_desktop | 11.0 | |
| novell | suse_linux_enterprise_server | 11.0 | |
| novell | suse_linux_enterprise_server | 11.0 | |
| novell | suse_linux_enterprise_server | 11.0 | |
| puppet | puppet_enterprise | * | |
| puppet | puppet_enterprise | 1.0 | |
| puppet | puppet_enterprise | 1.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.5.1 | |
| puppet | puppet_enterprise | 2.5.2 | |
| puppet | puppet_enterprise | 2.8.0 | |
| puppetlabs | puppet | 1.0.0 | |
| puppetlabs | puppet | 1.1.0 | |
| puppetlabs | puppet | 1.2.0 | |
| puppetlabs | puppet | 2.5.0 | |
| puppetlabs | puppet | 2.6.0 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 2.7.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.21:*:*:*:*:*:*:*",
"matchCriteriaId": "31787A8E-ACF2-477A-A101-96C298732631",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "867A327E-421F-46A9-877C-8A2911971E39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*",
"matchCriteriaId": "29BBE8DB-8560-4A57-9BCB-D709A697ECDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*",
"matchCriteriaId": "10E0543B-5B1D-4522-945D-98BD63380500",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*",
"matchCriteriaId": "817AB37A-F7B0-4E68-B10A-9E4A358793F3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12419C96-61A4-46B3-B8DA-FE3B8E7ACAEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
"matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
"matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_desktop:11:sp3:*:*:*:*:*:*",
"matchCriteriaId": "BD55EF8A-A5D3-4800-9737-3C4D63FF8058",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp2:*:*:*:*:*:*",
"matchCriteriaId": "4F519E49-D04A-442E-8F4F-4FCA93EEE544",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp2:*:*:*:vmware:*:*",
"matchCriteriaId": "6972ACC2-6855-4C98-93C1-DD216A5BD3A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:*:*:*",
"matchCriteriaId": "623DB4CD-8CB3-445A-B9B5-1238CF195235",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:vmware:*:*",
"matchCriteriaId": "83439D9C-2374-473C-8D64-C0DB886FEFB3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8EB5B299-B528-4C71-B2F1-6C47E52F75F0",
"versionEndIncluding": "2.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "926CFE0B-57A0-42EE-8B84-5C53C94F552E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "54836761-86C0-4240-8A43-D6DECC2BBBDA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32A5E42D-9626-4FC8-A032-4CD4FA1255BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06F0697C-A1BF-42FE-A036-F3E6FAB30A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C43CD3C-ACDB-418B-B67D-9C8EFAC0680C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.0.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "B3246614-F3C3-4D0A-B41F-B2158F5B0185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.1.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "36ECFB92-2695-4C88-8F78-4AC31E3FC890",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "0DAADB8A-3428-43D7-B79B-040F80B5C161",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "27BEF40A-546D-4A5D-8173-A6E3C715B4B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.6.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "FD3AE9E5-5439-439B-A628-1CCEB45D63AF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "49809A49-DD06-4335-9A09-EA35EB381B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "EE62E9E9-6183-4D43-B776-F6BA06AA292B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.2:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "26392E32-CB54-43F7-8EF2-00E860917F4A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call."
},
{
"lang": "es",
"value": "Puppet 2.7.x anterior a 2.7.22 y 3.2.x anterior a 3.2.2, y Puppet Enterprise anterior a 2.8.2, deserializa YAML sin confianza, lo que permite a atacantes remotos la instanciaci\u00f3n de clases de Ruby y ejecutar c\u00f3digo arbitrario a trav\u00e9s de una llamada RESTAPI manipulada."
}
],
"id": "CVE-2013-3567",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-19T23:55:08.523",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/54429"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2013/dsa-2715"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1886-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-3567/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/54429"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2715"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1886-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-3567/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-03-14 16:55
Modified
2025-04-12 10:46
Severity ?
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-1399 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-1399 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet_enterprise | * | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.5.1 | |
| puppet | puppet_enterprise | 2.5.2 | |
| puppetlabs | puppet | 2.5.0 | |
| puppetlabs | puppet | 2.6.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "945DC555-EDBC-4D34-B5CF-7AFDE130D4F4",
"versionEndIncluding": "2.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32A5E42D-9626-4FC8-A032-4CD4FA1255BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06F0697C-A1BF-42FE-A036-F3E6FAB30A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "27BEF40A-546D-4A5D-8173-A6E3C715B4B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.6.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "FD3AE9E5-5439-439B-A628-1CCEB45D63AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de CSRF en los componentes (1) gesti\u00f3n de solicitudes de nodo, (2) gesti\u00f3n viva y (3) administraci\u00f3n de usuario en la consola en Puppet Enterprise (PE) anterior a 2.7.1 permiten a atacantes remotos secuestrar la autenticaci\u00f3n de v\u00edctimas no especificadas a trav\u00e9s de vectores desconocidos."
}
],
"id": "CVE-2013-1399",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-03-14T16:55:04.660",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1399"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1399"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-01-07 18:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2013-4969 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/56253 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/56254 | Vendor Advisory | |
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2831 | Third Party Advisory | |
| cve@mitre.org | http://www.ubuntu.com/usn/USN-2077-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2013-4969 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/56253 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/56254 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2831 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-2077-1 | Third Party Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppetlabs | puppet | * | |
| puppetlabs | puppet | * | |
| puppet | puppet_enterprise | * | |
| puppet | puppet_enterprise | * | |
| debian | debian_linux | 6.0 | |
| debian | debian_linux | 7.0 | |
| debian | debian_linux | 8.0 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 12.10 | |
| canonical | ubuntu_linux | 13.04 | |
| canonical | ubuntu_linux | 13.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0230716D-527D-4B59-A445-2FE4B291385A",
"versionEndIncluding": "3.3.2",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "68737095-7EFD-45B4-9130-7D1079BE9A7B",
"versionEndExcluding": "3.4.1",
"versionStartIncluding": "3.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D7755947-2245-4362-AE35-3CCCB9773079",
"versionEndExcluding": "2.8.4",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B24D36A1-CEFC-45B8-BF39-6E82CFBE171D",
"versionEndExcluding": "3.1.1",
"versionStartIncluding": "3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "036E8A89-7A16-411F-9D31-676313BB7244",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
"matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*",
"matchCriteriaId": "7F61F047-129C-41A6-8A27-FFCBB8563E91",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files."
},
{
"lang": "es",
"value": "Puppet anteriores a 3.3.3. y 3.4 anteriores a 3.4.1 y Puppet Enterprise (PE) anteriores a 2.8.4 y 3.1 anteriores a 3.1.1 permite a usuarios locales sobreescribir ficheros arbitrarios a trav\u00e9s de un ataque de enlaces simb\u00f3licos en ficheros no especificados."
}
],
"id": "CVE-2013-4969",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-07T18:55:06.910",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4969"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56253"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56254"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2831"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2077-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4969"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56253"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56254"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2831"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2077-1"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-59"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-06-27 18:55
Modified
2025-04-11 00:51
Severity ?
Summary
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html | ||
| cve@mitre.org | http://projects.puppetlabs.com/issues/13606 | ||
| cve@mitre.org | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13 | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-1989/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48743 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/48748 | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/49136 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1419-1 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/52975 | ||
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/74797 | ||
| cve@mitre.org | https://hermes.opensuse.org/messages/15087408 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/issues/13606 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-1989/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48743 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/48748 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/49136 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1419-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/52975 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/74797 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://hermes.opensuse.org/messages/15087408 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 1.2.0 | |
| puppet | puppet_enterprise | 1.2.1 | |
| puppet | puppet_enterprise | 1.2.2 | |
| puppet | puppet_enterprise | 1.2.3 | |
| puppet | puppet_enterprise | 1.2.4 | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.0.1 | |
| puppet | puppet_enterprise | 2.0.2 | |
| puppet | puppet_enterprise | 2.5.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BFF8F62F-8782-4FD2-BC14-3F9E46881F0C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "36A3FDB9-F599-4999-A6B9-C82C7DAF5A70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "41C07E3C-4F96-4B91-8B2D-09076749FF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "76BD798A-9D06-4CC2-B40B-D377EBEBA5B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1389B834-FE5B-4CF7-93CC-63E919FC58CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "D8A8C568-1922-4701-BA61-DF960C43A6FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0DB5A3CC-05AA-4192-9527-7B55FC1121F7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log)."
},
{
"lang": "es",
"value": "telnet.rb en Puppet v2.7.x antes de v2.7.13 y Puppet Enterprise (PE) v1.2.x, v2.0.x, y v2.5.x antes de v2.5.1, permite a usuarios locales sobreescribir archivos de su elecci\u00f3n a trav\u00e9s de ataques de enlace simb\u00f3lico en el registro de conexi\u00f3n NET::Telnet (/tmp/out.log)."
}
],
"id": "CVE-2012-1989",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-06-27T18:55:01.430",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/issues/13606"
},
{
"source": "cve@mitre.org",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1989/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/49136"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74797"
},
{
"source": "cve@mitre.org",
"url": "https://hermes.opensuse.org/messages/15087408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-05/msg00012.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/issues/13606"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.7.13"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-1989/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48743"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/48748"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/49136"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1419-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/52975"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74797"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://hermes.opensuse.org/messages/15087408"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-06 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-3865/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/50014 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2511 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1506-1 | ||
| cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=839131 | ||
| cve@mitre.org | https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f | Exploit, Patch | |
| cve@mitre.org | https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-3865/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/50014 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2511 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1506-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=839131 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6 | Exploit, Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppetlabs | puppet | * | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.6.15 | |
| puppetlabs | puppet | * | |
| puppet | puppet_enterprise | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A81EA6F-49C7-4883-8F93-E76A60DE1164",
"versionEndIncluding": "2.7.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6F41EF-556F-42E0-B26C-B96CD9C77B2B",
"versionEndIncluding": "2.6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F66C1E54-FBEA-4008-BC88-A390D415F3F5",
"versionEndIncluding": "2.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."
},
{
"lang": "es",
"value": "Vulnerabilidad de directorio transversal en lib/puppet/reports/store.rb en Puppet anterior a v2.6.17 y v2.7.x anterior a v2.7.18, y Puppet Enterprise anterior a v2.5.2, cuando Eliminar est\u00e1 habilitado en auth.conf, permite a usuarios remotos autenticados borrar archivos arbitrarios en el servidor maestro de las marionetas a trav\u00e9s de un .. (punto punto) en un nombre de nodo."
}
],
"id": "CVE-2012-3865",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-08-06T16:55:06.070",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-20 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | Third Party Advisory | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | Third Party Advisory | |
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0710.html | Third Party Advisory | |
| cve@mitre.org | http://secunia.com/advisories/52596 | Third Party Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1759-1 | Third Party Advisory | |
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2643 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/58449 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-2275/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0710.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52596 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1759-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2643 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/58449 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-2275/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.6.15 | |
| puppet | puppet | 2.6.16 | |
| puppetlabs | puppet | * | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppet | puppet | 2.7.18 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 2.7.19 | |
| puppetlabs | puppet | 2.7.20 | |
| puppetlabs | puppet | 2.7.20 | |
| puppet | puppet_enterprise | 3.1.0 | |
| puppetlabs | puppet | * | |
| puppet | puppet_enterprise | 2.7.0 | |
| puppet | puppet_enterprise | 2.7.1 | |
| canonical | ubuntu_linux | 11.10 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 12.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "04B6142C-AFC5-4045-8FA1-C07F2BEF487C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A703C12C-D698-40C6-9081-2B00624C578D",
"versionEndIncluding": "2.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*",
"matchCriteriaId": "29BBE8DB-8560-4A57-9BCB-D709A697ECDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*",
"matchCriteriaId": "10E0543B-5B1D-4522-945D-98BD63380500",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*",
"matchCriteriaId": "817AB37A-F7B0-4E68-B10A-9E4A358793F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CFF3B0A-2C66-445A-BB5C-136DCAA584FE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "2A463920-9470-41AB-947B-B2DD7A3AF7C1",
"versionEndIncluding": "1.2.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3227E6D-27C8-4D6C-A9B7-713558FD9947",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3153F6B2-9CB2-4A1D-834B-33820EC8F0A0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E4174F4F-149E-41A6-BBCC-D01114C05F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors."
},
{
"lang": "es",
"value": "La configuraci\u00f3n por defecto para puppet masters v0.25.0 y posteriores en Puppet anterior a v2.6.18, v2.7.x anterior a v2.7.21 y v3.1.x anterior a 3.1.1, y Puppet Enterprise anterior a v1.2.7 y v2.7.x anterior a v2.7.2, permite a los nodos remotos autenticados enviar informes para otros nodos a trav\u00e9s de vectores no especificados."
}
],
"evaluatorImpact": "Per http://www.ubuntu.com/usn/usn-1759-1/\r\n\"A security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n Ubuntu 12.10\r\n Ubuntu 12.04 LTS\r\n Ubuntu 11.10\"",
"id": "CVE-2013-2275",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-03-20T16:55:01.843",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/58449"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2275/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/58449"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2275/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-20 22:55
Modified
2025-04-11 00:51
Severity ?
Summary
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2013-4761/ | Vendor Advisory | |
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-1283.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-1284.html | ||
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2761 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2013-4761/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1283.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1284.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2761 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 3.2.1 | |
| puppet | puppet | 3.2.2 | |
| puppet | puppet | 3.2.3 | |
| puppetlabs | puppet | 3.2.0 | |
| puppet | puppet | 2.7.2 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | 2.8.0 | |
| puppet | puppet_enterprise | 2.8.1 | |
| puppet | puppet_enterprise | 2.8.2 | |
| puppet | puppet_enterprise | 3.0.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "867A327E-421F-46A9-877C-8A2911971E39",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "75BA8116-F64D-4CB2-A4DE-B21864962029",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B4F1986C-D984-4B90-A790-5D247902AB8F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "12419C96-61A4-46B3-B8DA-FE3B8E7ACAEF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3C43CD3C-ACDB-418B-B67D-9C8EFAC0680C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "BD8F80AD-1E8E-40BE-883D-6F7F61D4A274",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9C6E27BB-6444-49E2-8B89-D7E09284D29C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "EE0A2F50-A73B-4598-BE73-1DDA1084352A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master."
},
{
"lang": "es",
"value": "Vulnerabilidad sin especificar en Puppet 2.7.x anterior a 2.7.23 y 3.2.x anterior a 3.2.4, y Puppet Enterprise 2.8.x anterior a 2.8.3 y 3.0.x anterior a 3.0.1, permite a atacantes remotos ejecutar programas Ruby arbitrariamente desde el master a trav\u00e9s del servicio resource_type. NOTA: esta vulnerabilidad \u00fanicamente puede ser explotada utilizando un \"acceso local al sistema de ficheros no especificado\" al Puppet Master."
}
],
"id": "CVE-2013-4761",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-20T22:55:04.297",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4761/"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2013/dsa-2761"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-4761/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1283.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1284.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2761"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-20 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | Mailing List, Third Party Advisory | |
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0710.html | Third Party Advisory | |
| cve@mitre.org | http://secunia.com/advisories/52596 | Third Party Advisory, Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1759-1 | Third Party Advisory | |
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2643 | Third Party Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/58443 | Third Party Advisory, VDB Entry | |
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-1652/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | Mailing List, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0710.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52596 | Third Party Advisory, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1759-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2643 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/58443 | Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-1652/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppetlabs | puppet | * | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppet | puppet | 2.7.18 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 2.7.19 | |
| puppetlabs | puppet | 2.7.20 | |
| puppetlabs | puppet | 2.7.20 | |
| puppet | puppet_enterprise | 3.1.0 | |
| puppetlabs | puppet | * | |
| puppet | puppet_enterprise | 2.7.0 | |
| puppet | puppet_enterprise | 2.7.1 | |
| canonical | ubuntu_linux | 11.10 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 12.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A703C12C-D698-40C6-9081-2B00624C578D",
"versionEndIncluding": "2.6.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*",
"matchCriteriaId": "29BBE8DB-8560-4A57-9BCB-D709A697ECDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*",
"matchCriteriaId": "10E0543B-5B1D-4522-945D-98BD63380500",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*",
"matchCriteriaId": "817AB37A-F7B0-4E68-B10A-9E4A358793F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CFF3B0A-2C66-445A-BB5C-136DCAA584FE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "2A463920-9470-41AB-947B-B2DD7A3AF7C1",
"versionEndIncluding": "1.2.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3227E6D-27C8-4D6C-A9B7-713558FD9947",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "3153F6B2-9CB2-4A1D-834B-33820EC8F0A0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E4174F4F-149E-41A6-BBCC-D01114C05F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master\u0027s cache via unspecified vectors."
},
{
"lang": "es",
"value": "Puppet anterior a v2.6.18, v2.7.x anterior a v2.7.21, y v3.1.x anterior a v3.1.1, y Puppet Enterprise anterior a v1.2.7 y v2.7.x anterior a v2.7.2 permite a usuarios remotos autenticados con un certificado v\u00e1lido y una clave privada leer catalogs arbitrarios o envenenar la cach\u00e9 del maestro a trav\u00e9s de vectores no especificados.\r\n"
}
],
"evaluatorImpact": "Per http://www.ubuntu.com/usn/usn-1759-1/\r\n\"A security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n Ubuntu 12.10\r\n Ubuntu 12.04 LTS\r\n Ubuntu 11.10\"",
"id": "CVE-2013-1652",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-03-20T16:55:01.753",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/58443"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1652/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/58443"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1652/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-20 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0710.html | ||
| cve@mitre.org | http://secunia.com/advisories/52596 | Vendor Advisory | |
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2643 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/58447 | ||
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-2274/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0710.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52596 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2643 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/58447 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-2274/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.6.15 | |
| puppet | puppet | 2.6.16 | |
| puppetlabs | puppet | 2.6.17 | |
| puppet | puppet_enterprise | 1.2.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.16:*:*:*:*:*:*:*",
"matchCriteriaId": "04B6142C-AFC5-4045-8FA1-C07F2BEF487C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.6.17:*:*:*:*:*:*:*",
"matchCriteriaId": "0AED05EE-5038-4F3E-B4C2-4926CAE4A9BE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0A584D14-197E-47EB-B394-B8B211D4B502",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report."
},
{
"lang": "es",
"value": "Puppet v2.6.x anterior a v2.6.18 y Puppet Enterprise v1.2.x anterior a v1.2.7 permite a usuarios remotos autenticados ejecutar c\u00f3digo arbitrario en el puppet master, o un agente con puppet kick habilitado, mediante una petici\u00f3n espcialmente dies\u00f1ada para un report."
}
],
"id": "CVE-2013-2274",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-03-20T16:55:01.827",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/58447"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2274/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/58447"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2274/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-06 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html | Third Party Advisory | |
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | Third Party Advisory | |
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-3867/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/50014 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2511 | Third Party Advisory | |
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1506-1 | Third Party Advisory | |
| cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=839158 | Issue Tracking | |
| cve@mitre.org | https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 | Exploit, Issue Tracking, Patch | |
| cve@mitre.org | https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 | Exploit, Issue Tracking, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-3867/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/50014 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2511 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1506-1 | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=839158 | Issue Tracking | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 | Exploit, Issue Tracking, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 | Exploit, Issue Tracking, Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.6.15 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppetlabs | puppet | * | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| debian | debian_linux | 6.0 | |
| canonical | ubuntu_linux | 10.04 | |
| canonical | ubuntu_linux | 11.04 | |
| canonical | ubuntu_linux | 11.10 | |
| canonical | ubuntu_linux | 12.04 | |
| opensuse | opensuse | 11.4 | |
| opensuse | opensuse | 12.1 | |
| suse | linux_enterprise_desktop | 11 | |
| suse | linux_enterprise_desktop | 11 | |
| suse | linux_enterprise_server | 11 | |
| suse | linux_enterprise_server | 11 | |
| suse | linux_enterprise_server | 11 | |
| puppet | puppet_enterprise | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6F41EF-556F-42E0-B26C-B96CD9C77B2B",
"versionEndIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "036E8A89-7A16-411F-9D31-676313BB7244",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "5D37DF0F-F863-45AC-853A-3E04F9FEC7CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*",
"matchCriteriaId": "EF49D26F-142E-468B-87C1-BABEA445255C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E4174F4F-149E-41A6-BBCC-D01114C05F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*",
"matchCriteriaId": "DE554781-1EB9-446E-911F-6C11970C47F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EBB2C482-D2A4-48B3-ACE7-E1DFDCC409B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*",
"matchCriteriaId": "60FBDD82-691C-4D9D-B71B-F9AFF6931B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*",
"matchCriteriaId": "00720D8C-3FF3-4B1C-B74B-91F01A544399",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*",
"matchCriteriaId": "EE26596F-F10E-44EF-88CA-0080646E91B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*",
"matchCriteriaId": "A6B7CDCA-6F39-4113-B5D3-3AA9D7F3D809",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:*:*:*",
"matchCriteriaId": "F084E6C1-8DB0-4D1F-B8EB-5D2CD9AD6E87",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F66C1E54-FBEA-4008-BC88-A390D415F3F5",
"versionEndIncluding": "2.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences."
},
{
"lang": "es",
"value": "lib/puppet/ssl/certificate_authority.rb en Puppet anteriores a v2.6.17 y v2.7.x anteriores a v2.7.18, y Puppet Enterprise anterior a v2.5.2, no restringe de forma adecuada los caracteres en el campo Common Name de una Certificate Signing Request (CSR), lo que facilita a atacantes remotos asistidos por usuarios a enga\u00f1ar a los administradores para firmar un certificado manipulado a trav\u00e9s de secuencias de control ANSI.\r\n\r\n"
}
],
"id": "CVE-2012-3867",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2012-08-06T16:55:06.680",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Issue Tracking",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2012-08-06 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | ||
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-3864/ | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/50014 | ||
| cve@mitre.org | http://www.debian.org/security/2012/dsa-2511 | ||
| cve@mitre.org | http://www.ubuntu.com/usn/USN-1506-1 | ||
| cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=839130 | ||
| cve@mitre.org | https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4 | Exploit, Patch | |
| cve@mitre.org | https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2012-3864/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/50014 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2012/dsa-2511 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1506-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=839130 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87 | Exploit, Patch |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.6.0 | |
| puppet | puppet | 2.6.1 | |
| puppet | puppet | 2.6.2 | |
| puppet | puppet | 2.6.3 | |
| puppet | puppet | 2.6.4 | |
| puppet | puppet | 2.6.5 | |
| puppet | puppet | 2.6.6 | |
| puppet | puppet | 2.6.7 | |
| puppet | puppet | 2.6.8 | |
| puppet | puppet | 2.6.9 | |
| puppet | puppet | 2.6.10 | |
| puppet | puppet | 2.6.11 | |
| puppet | puppet | 2.6.12 | |
| puppet | puppet | 2.6.13 | |
| puppet | puppet | 2.6.14 | |
| puppet | puppet | 2.6.15 | |
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppetlabs | puppet | * | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppet | puppet_enterprise | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6F41EF-556F-42E0-B26C-B96CD9C77B2B",
"versionEndIncluding": "2.6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F66C1E54-FBEA-4008-BC88-A390D415F3F5",
"versionEndIncluding": "2.5.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request."
},
{
"lang": "es",
"value": "Puppet anterior a v2.6.17 y v2.7.x anterior a v2.7.18 y Puppet Enterprise anterior a v2.5.2,\r\npermite a usuarios remotos autenticados a leer ficheros de su elecci\u00f3n en el servidor maestro de Puppet aprovechando un certificado de usuario y una clave privada en una petici\u00f3n GET."
}
],
"id": "CVE-2012-3864",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2012-08-06T16:55:06.040",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "cve@mitre.org",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/50014"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2511"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1506-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-03-20 16:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | ||
| cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0710.html | ||
| cve@mitre.org | http://secunia.com/advisories/52596 | Vendor Advisory | |
| cve@mitre.org | http://ubuntu.com/usn/usn-1759-1 | ||
| cve@mitre.org | http://www.debian.org/security/2013/dsa-2643 | ||
| cve@mitre.org | http://www.securityfocus.com/bid/64758 | ||
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-1654/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0710.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52596 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://ubuntu.com/usn/usn-1759-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.debian.org/security/2013/dsa-2643 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/64758 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-1654/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet | 2.7.2 | |
| puppet | puppet | 2.7.3 | |
| puppet | puppet | 2.7.4 | |
| puppet | puppet | 2.7.5 | |
| puppet | puppet | 2.7.6 | |
| puppet | puppet | 2.7.7 | |
| puppet | puppet | 2.7.8 | |
| puppet | puppet | 2.7.9 | |
| puppet | puppet | 2.7.10 | |
| puppet | puppet | 2.7.11 | |
| puppet | puppet | 2.7.12 | |
| puppet | puppet | 2.7.13 | |
| puppet | puppet | 2.7.14 | |
| puppet | puppet | 2.7.16 | |
| puppet | puppet | 2.7.17 | |
| puppet | puppet | 2.7.18 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| puppetlabs | puppet | 2.7.19 | |
| puppetlabs | puppet | 2.7.20 | |
| puppetlabs | puppet | 2.7.20 | |
| puppet | puppet_enterprise | 3.1.0 | |
| puppetlabs | puppet | 2.7.0 | |
| puppetlabs | puppet | 2.7.1 | |
| canonical | ubuntu_linux | 11.10 | |
| canonical | ubuntu_linux | 12.04 | |
| canonical | ubuntu_linux | 12.10 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "390FC5AE-4939-468C-B323-6B4E267A0F4C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*",
"matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*",
"matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*",
"matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*",
"matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*",
"matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*",
"matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*",
"matchCriteriaId": "FEBB3936-7A81-4BD9-80B2-3F614980BBCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A1EABC0F-A7A6-4C28-9331-3EEB6D39A0C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*",
"matchCriteriaId": "29BBE8DB-8560-4A57-9BCB-D709A697ECDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*",
"matchCriteriaId": "10E0543B-5B1D-4522-945D-98BD63380500",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*",
"matchCriteriaId": "817AB37A-F7B0-4E68-B10A-9E4A358793F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "3CFF3B0A-2C66-445A-BB5C-136DCAA584FE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "49809A49-DD06-4335-9A09-EA35EB381B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "EE62E9E9-6183-4D43-B776-F6BA06AA292B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E4174F4F-149E-41A6-BBCC-D01114C05F38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
"matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
"matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors."
},
{
"lang": "es",
"value": "Puppet v2.7.x anterior a v2.7.21 y v3.1.x anterior a v3.1.1, y Puppet Enterprise v2.7.x anterior a v2.7.2, no negocian correctamente el protocolo SSL entre el cliente y el master, lo que permite a atacantes remotos llevar a cabo ataques SSLv2 contra sesiones SSLv3 mediante vectores no especificados."
}
],
"evaluatorImpact": "Per http://www.ubuntu.com/usn/usn-1759-1/\r\n\"A security issue affects these releases of Ubuntu and its derivatives:\r\n\r\n Ubuntu 12.10\r\n Ubuntu 12.04 LTS\r\n Ubuntu 11.10\r\n\"",
"id": "CVE-2013-1654",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-03-20T16:55:01.790",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "cve@mitre.org",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/64758"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1654/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0710.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52596"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://ubuntu.com/usn/usn-1759-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2013/dsa-2643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/64758"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-1654/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-03-14 16:55
Modified
2025-04-12 10:46
Severity ?
Summary
The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://puppetlabs.com/security/cve/cve-2013-1398 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://puppetlabs.com/security/cve/cve-2013-1398 | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet_enterprise | * | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.5.1 | |
| puppet | puppet_enterprise | 2.5.2 | |
| puppetlabs | puppet | 2.5.0 | |
| puppetlabs | puppet | 2.6.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "945DC555-EDBC-4D34-B5CF-7AFDE130D4F4",
"versionEndIncluding": "2.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32A5E42D-9626-4FC8-A032-4CD4FA1255BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06F0697C-A1BF-42FE-A036-F3E6FAB30A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "27BEF40A-546D-4A5D-8173-A6E3C715B4B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.6.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "FD3AE9E5-5439-439B-A628-1CCEB45D63AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role."
},
{
"lang": "es",
"value": "El m\u00f3dulo pe_mcollective en Puppet Enterprise (PE) anterior a 2.7.1 no restringe debidamente acceso al cat\u00e1logo de claves privadas de SSL, lo que permite a usuarios remotos autenticados obtener informaci\u00f3n sensible y ganar privilegios mediante el aprovechamiento de un acceso root hacia un nodo, relacionado con el rol maestro."
}
],
"id": "CVE-2013-1398",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "COMPLETE",
"baseScore": 8.5,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-03-14T16:55:04.630",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-1398"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://puppetlabs.com/security/cve/cve-2013-1398"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-04-10 15:55
Modified
2025-04-11 00:51
Severity ?
Summary
Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://secunia.com/advisories/52862 | Vendor Advisory | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/83171 | ||
| cve@mitre.org | https://puppetlabs.com/security/cve/cve-2013-2716/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52862 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/83171 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppetlabs.com/security/cve/cve-2013-2716/ | Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| puppet | puppet_enterprise | * | |
| puppet | puppet_enterprise | 2.0.0 | |
| puppet | puppet_enterprise | 2.5.1 | |
| puppet | puppet_enterprise | 2.5.2 | |
| puppetlabs | puppet | 1.0.0 | |
| puppetlabs | puppet | 1.1.0 | |
| puppetlabs | puppet | 1.2.0 | |
| puppetlabs | puppet | 2.5.0 | |
| puppetlabs | puppet | 2.6.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0476F05B-92F5-469A-8B75-D8414B14E79E",
"versionEndIncluding": "2.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "CCFA5742-38F2-43BD-9C90-E4F447F55684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32A5E42D-9626-4FC8-A032-4CD4FA1255BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "06F0697C-A1BF-42FE-A036-F3E6FAB30A87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.0.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "B3246614-F3C3-4D0A-B41F-B2158F5B0185",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.1.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "36ECFB92-2695-4C88-8F78-4AC31E3FC890",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:1.2.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "0DAADB8A-3428-43D7-B79B-040F80B5C161",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "27BEF40A-546D-4A5D-8173-A6E3C715B4B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:puppetlabs:puppet:2.6.0:-:enterprise:*:*:*:*:*",
"matchCriteriaId": "FD3AE9E5-5439-439B-A628-1CCEB45D63AF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Puppet Labs Puppet Enterprise before 2.8.0 does not use a \"randomized secret\" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie."
},
{
"lang": "es",
"value": "Puppet Labs Puppet Enterprise antes de v2.8.0 no utiliza un \"secreto aleatorio\" en el archivo de configuraci\u00f3n de cliente de CAS (cas_client_config.yml) que al actualizarse desde versiones v1.2.x v2.0.x o, permite a atacantes remotos obtener acceso a la consola a trav\u00e9s de un cookie hecha a mano."
}
],
"id": "CVE-2013-2716",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-04-10T15:55:15.313",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52862"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83171"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2716/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52862"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83171"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://puppetlabs.com/security/cve/cve-2013-2716/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-310"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}