CVEvulnerability

CVE-2011-3872

2.6 LOW Published 2011-10-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-10-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
Weaknesses
CWE-20

Description

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

Affected configurations

• puppet puppet 2.6.0 • puppet puppet 2.6.1 • puppet puppet 2.6.2 • puppet puppet 2.6.3 • puppet puppet 2.6.4 • puppet puppet 2.6.5 • puppet puppet 2.6.6 • puppet puppet 2.6.7 • puppet puppet 2.6.8 • puppet puppet 2.6.9 • puppet puppet 2.6.10 • puppet puppet 2.6.11 • puppet puppet 2.7.2 • puppet puppet 2.7.3 • puppet puppet 2.7.4 • puppet puppet 2.7.5 • puppetlabs puppet 2.7.0 • puppetlabs puppet 2.7.1 • puppet puppet enterprise 1.2.0 • puppet puppet enterprise 1.2.1 • puppet puppet enterprise 1.2.2 • puppet puppet enterprise 1.2.3 • puppetlabs puppet enterprise users 1.0 • puppetlabs puppet enterprise users 1.1

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References