CVEvulnerability
CVE-2012-1988
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-05-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-78
Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Affected configurations
• puppet puppet (>= 2.6.0 < 2.6.15)
• puppet puppet (>= 2.7.0 < 2.7.13)
• puppet puppet enterprise (>= 1.2.0 < 2.5.1)
• puppet puppet enterprise 1.0
• puppet puppet enterprise 1.1
• fedoraproject fedora 15
• fedoraproject fedora 16
• fedoraproject fedora 17
• debian debian linux 6.0
• debian debian linux 7.0
• canonical ubuntu linux 10.04
• canonical ubuntu linux 11.04
• canonical ubuntu linux 11.10
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
Referenced by CWE · observed example (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html Mailing List, Third Party Advisory
- http://projects.puppetlabs.com/issues/13518 Broken Link, Vendor Advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 Broken Link
- http://puppetlabs.com/security/cve/cve-2012-1988/ Broken Link, Vendor Advisory
- http://secunia.com/advisories/48743 Broken Link, Vendor Advisory
- http://secunia.com/advisories/48748 Broken Link, Vendor Advisory
- http://secunia.com/advisories/48789 Broken Link, Vendor Advisory
- http://secunia.com/advisories/49136 Broken Link, Vendor Advisory
- http://ubuntu.com/usn/usn-1419-1 Third Party Advisory
- http://www.debian.org/security/2012/dsa-2451 Third Party Advisory
- http://www.osvdb.org/81309 Broken Link
- http://www.securityfocus.com/bid/52975 Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74796 Third Party Advisory, VDB Entry
- https://hermes.opensuse.org/messages/14523305 Broken Link
- https://hermes.opensuse.org/messages/15087408 Broken Link
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html Mailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html Mailing List, Third Party Advisory
- http://projects.puppetlabs.com/issues/13518 Broken Link, Vendor Advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 Broken Link
- http://puppetlabs.com/security/cve/cve-2012-1988/ Broken Link, Vendor Advisory
- http://secunia.com/advisories/48743 Broken Link, Vendor Advisory
- http://secunia.com/advisories/48748 Broken Link, Vendor Advisory
- http://secunia.com/advisories/48789 Broken Link, Vendor Advisory
- http://secunia.com/advisories/49136 Broken Link, Vendor Advisory
- http://ubuntu.com/usn/usn-1419-1 Third Party Advisory
- http://www.debian.org/security/2012/dsa-2451 Third Party Advisory
- http://www.osvdb.org/81309 Broken Link
- http://www.securityfocus.com/bid/52975 Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74796 Third Party Advisory, VDB Entry
- https://hermes.opensuse.org/messages/14523305 Broken Link
- https://hermes.opensuse.org/messages/15087408 Broken Link