CVE-2012-3866

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

• puppet puppet 2.7.2 • puppet puppet 2.7.3 • puppet puppet 2.7.4 • puppet puppet 2.7.5 • puppet puppet 2.7.6 • puppet puppet 2.7.8 • puppet puppet 2.7.9 • puppet puppet 2.7.10 • puppet puppet 2.7.11 • puppet puppet 2.7.12 • puppet puppet 2.7.13 • puppet puppet 2.7.14 • puppet puppet 2.7.16 • puppetlabs puppet (<= 2.7.17) • puppetlabs puppet 2.7.0 • puppetlabs puppet 2.7.1 • puppet puppet enterprise (<= 2.5.1)