CVE-2012-1988
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute…
Does this matter?
Lower severity and a low EPSS score (2.63%). Track it; it rarely justifies an emergency change on its own.
Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 2.63% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- puppet/puppet · puppet/puppet enterprise · fedoraproject/fedora · debian/debian linux · canonical/ubuntu linux
- Source
- cve@mitre.org
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.htmlMailing List, Third Party Advisory
- http://projects.puppetlabs.com/issues/13518Broken Link, Vendor Advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15Broken Link
- http://puppetlabs.com/security/cve/cve-2012-1988/Broken Link, Vendor Advisory
- http://secunia.com/advisories/48743Broken Link, Vendor Advisory
- http://secunia.com/advisories/48748Broken Link, Vendor Advisory
- http://secunia.com/advisories/48789Broken Link, Vendor Advisory
- http://secunia.com/advisories/49136Broken Link, Vendor Advisory
- http://ubuntu.com/usn/usn-1419-1Third Party Advisory
- http://www.debian.org/security/2012/dsa-2451Third Party Advisory
- http://www.osvdb.org/81309Broken Link
- http://www.securityfocus.com/bid/52975Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74796Third Party Advisory, VDB Entry
- https://hermes.opensuse.org/messages/14523305Broken Link
- https://hermes.opensuse.org/messages/15087408Broken Link
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.htmlMailing List, Third Party Advisory
- http://projects.puppetlabs.com/issues/13518Broken Link, Vendor Advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15Broken Link
- http://puppetlabs.com/security/cve/cve-2012-1988/Broken Link, Vendor Advisory
- http://secunia.com/advisories/48743Broken Link, Vendor Advisory
- http://secunia.com/advisories/48748Broken Link, Vendor Advisory
- http://secunia.com/advisories/48789Broken Link, Vendor Advisory
- http://secunia.com/advisories/49136Broken Link, Vendor Advisory
- http://ubuntu.com/usn/usn-1419-1Third Party Advisory
- http://www.debian.org/security/2012/dsa-2451Third Party Advisory
- http://www.osvdb.org/81309Broken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.