PT-2012-5050 · Puppet+1 · Puppet+2

Publicado 2012-08-06 · Atualizado 2019-07-10 · CVE-2012-3867

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.6.17 Puppet versions 2.7.x prior to 2.7.18 Puppet Enterprise versions prior to 2.5.2

Description The issue arises from the improper restriction of characters in the Common Name field of a Certificate Signing Request (CSR) in the lib/puppet/ssl/certificate authority.rb file. This makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Recommendations For Puppet versions prior to 2.6.17, update to version 2.6.17 or later. For Puppet versions 2.7.x prior to 2.7.18, update to version 2.7.18 or later. For Puppet Enterprise versions prior to 2.5.2, update to version 2.5.2 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-3867

DSA-2511-1

GHSA-Q44R-F2HM-V76V

OPENSUSE-SU-2024:10581-1

Produtos afetados

Puppet

Puppet Enterprise

Suse

Referências · 17

• 🔥 https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 · Exploit
• 🔥 https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3867.yml · Exploit
• https://github.com/puppetlabs/puppet · Nota
• http://debian.org/security/2012/dsa-2511 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-1506-1 · Aviso do Fabricante
• http://puppetlabs.com/security/cve/cve-2012-3867 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html · Aviso do Fabricante
• http://secunia.com/advisories/50014 · Nota
• https://osv.dev/vulnerability/CVE-2012-3867 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-3867 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3867 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=839158 · Nota
• https://puppet.com/security/cve/cve-2012-3867-insufficient-input-validation · Nota