PT-2012-1142 · Puppet+1 · Puppet+2

Published 2012-05-29 · Updated 2025-11-20 · CVE-2012-1987

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Puppet versions 2.6.x through 2.6.14 Puppet versions 2.7.x through 2.7.12 Puppet Enterprise (PE) Users versions 1.0 through 1.2.x Puppet Enterprise (PE) Users versions 2.0.x through 2.5.0

Description The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely by an authenticated attacker. The vulnerability allows remote authenticated users with agent SSL keys to cause a denial of service, either through memory consumption via a REST request to a stream that triggers a thread block, or through filesystem consumption via crafted REST requests that use a marshaled form of a Puppet::FileBucket::File object to write to arbitrary file locations.

Recommendations For Puppet versions 2.6.x through 2.6.14, update to version 2.6.15 or later. For Puppet versions 2.7.x through 2.7.12, update to version 2.7.13 or later. For Puppet Enterprise (PE) Users versions 1.0 through 1.2.x, update to a version after 2.5.0. For Puppet Enterprise (PE) Users versions 2.0.x through 2.5.0, update to version 2.5.1 or later. As a temporary workaround, consider restricting access to the REST API to minimize the risk of exploitation. Avoid using the Puppet::FileBucket::File object in crafted REST requests until the issue is resolved.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-264

Related Identifiers

BDU:2015-09668

CVE-2012-1987

DSA-2451-1

GHSA-V58W-6XC2-W799

Affected Products

Puppet

Puppet Enterprise (Pe) Users

Suse

References · 38

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1987.yml · Exploit
• https://hermes.opensuse.org/messages/15087408 · Vendor Advisory
• http://projects.puppetlabs.com/issues/13553 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html · Vendor Advisory
• http://ubuntu.com/usn/usn-1419-1 · Vendor Advisory
• http://secunia.com/advisories/48789 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html · Vendor Advisory
• http://debian.org/security/2012/dsa-2451 · Vendor Advisory
• http://secunia.com/advisories/49136 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1987 · Security Note
• https://bdu.fstec.ru/vul/2015-09668 · Security Note
• http://secunia.com/advisories/48743 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html · Vendor Advisory
• http://projects.puppetlabs.com/issues/13552 · Vendor Advisory