PT-2012-5050 · Puppet+1 · Puppet+2

Published 2012-08-06 · Updated 2019-07-10 · CVE-2012-3867

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Puppet versions prior to 2.6.17 Puppet versions 2.7.x prior to 2.7.18 Puppet Enterprise versions prior to 2.5.2

Description The issue arises from the improper restriction of characters in the Common Name field of a Certificate Signing Request (CSR) in the lib/puppet/ssl/certificate authority.rb file. This makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Recommendations For Puppet versions prior to 2.6.17, update to version 2.6.17 or later. For Puppet versions 2.7.x prior to 2.7.18, update to version 2.7.18 or later. For Puppet Enterprise versions prior to 2.5.2, update to version 2.5.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-3867

DSA-2511-1

GHSA-Q44R-F2HM-V76V

OPENSUSE-SU-2024:10581-1

Affected Products

Puppet

Puppet Enterprise

Suse

References · 17

• 🔥 https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 · Exploit
• 🔥 https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3867.yml · Exploit
• http://debian.org/security/2012/dsa-2511 · Vendor Advisory
• http://ubuntu.com/usn/USN-1506-1 · Vendor Advisory
• http://puppetlabs.com/security/cve/cve-2012-3867 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-3867 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3867 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3867 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3867 · Security Note
• https://osv.dev/vulnerability/GHSA-q44r-f2hm-v76v · Vendor Advisory
• https://github.com/puppetlabs/puppet · Note
• http://secunia.com/advisories/50014 · Note