GitHub Advisoryadvisory · RubyGems
GHSA-vxf6-w9mp-95hm Puppet supports use of IP addresses in certnames without warning of potential risks
LOW
Official page ↗
- Aliases
- CVE-2012-3408
- Ecosystem
- RubyGems
- Packages
- puppet
- Severity
- Low
- Weaknesses
- CWE-287
- Reviewed
- 2020-06-16
Affected packages
• RubyGems puppet: < 2.7.18 → fixed in 2.7.18
Description
`lib/puppet/network/authstore.rb` in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Related
Alias · CVE (1)
- CVE-2012-3408 lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2012-3408 advisory
- https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd web
- https://bugzilla.redhat.com/show_bug.cgi?id=839166 web
- https://github.com/puppetlabs/puppet package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3408.yml web
- https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation web
- http://puppetlabs.com/security/cve/cve-2012-3408 web