GitHub Advisoryadvisory · RubyGems
GHSA-6xxq-j39w-g3f6 Puppet Arbitrary Command Execution
MEDIUM
Official page ↗
- Aliases
- CVE-2012-1988
- Ecosystem
- RubyGems
- Packages
- puppet
- Severity
- Moderate
- Weaknesses
- CWE-77, CWE-78
- Reviewed
- 2024-01-12
Affected packages
• RubyGems puppet: >= 2.6.0, < 2.6.15 → fixed in 2.6.15
• RubyGems puppet: >= 2.7.0, < 2.7.13 → fixed in 2.7.13
Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Related
Alias · CVE (1)
- CVE-2012-1988 Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-1988 advisory
- https://github.com/puppetlabs/puppet/commit/0d6d29933e613fe177e9235415919a5428db67bc web
- https://github.com/puppetlabs/puppet/commit/568ded50ec6cc498ad32ff7f086d9f73b5d24c14 web
- https://web.archive.org/web/20121031092646/http://www.securityfocus.com/bid/52975 web
- https://web.archive.org/web/20121025194938/http://secunia.com/advisories/48743 web
- https://web.archive.org/web/20121025194830/http://secunia.com/advisories/49136 web
- https://web.archive.org/web/20121025113446/http://secunia.com/advisories/48748 web
- https://web.archive.org/web/20121025112409/http://secunia.com/advisories/48789 web
- https://web.archive.org/web/20121013181707/http://puppetlabs.com/security/cve/cve-2012-1988 web
- https://web.archive.org/web/20120816020421/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 web
- https://web.archive.org/web/20120513213112/http://projects.puppetlabs.com/issues/13518 web
- https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975 web
- https://hermes.opensuse.org/messages/15087408 web
- https://hermes.opensuse.org/messages/14523305 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1988.yml web
- https://github.com/puppetlabs/puppet package
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74796 web
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html web
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html web
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html web
- http://projects.puppetlabs.com/issues/13518 web
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15 web
- http://puppetlabs.com/security/cve/cve-2012-1988 web
- http://ubuntu.com/usn/usn-1419-1 web
- http://www.debian.org/security/2012/dsa-2451 web