Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Metrics
CVSS 2.0 6.0/10
AV:N/AC:M/Au:S/C:P/I:P/A:PWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.htmlMailing List, Third Party Advisory
- http://projects.puppetlabs.com/issues/13518Broken Link, Vendor Advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15Broken Link
- http://puppetlabs.com/security/cve/cve-2012-1988/Broken Link, Vendor Advisory
- http://secunia.com/advisories/48743Broken Link, Vendor Advisory
- http://secunia.com/advisories/48748Broken Link, Vendor Advisory
- http://secunia.com/advisories/48789Broken Link, Vendor Advisory
- http://secunia.com/advisories/49136Broken Link, Vendor Advisory
- http://ubuntu.com/usn/usn-1419-1Third Party Advisory
- http://www.debian.org/security/2012/dsa-2451Third Party Advisory
- http://www.osvdb.org/81309Broken Link
- http://www.securityfocus.com/bid/52975Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74796Third Party Advisory, VDB Entry
- https://hermes.opensuse.org/messages/14523305Broken Link
- https://hermes.opensuse.org/messages/15087408Broken Link
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.htmlMailing List, Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.htmlMailing List, Third Party Advisory
- http://projects.puppetlabs.com/issues/13518Broken Link, Vendor Advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15Broken Link
- http://puppetlabs.com/security/cve/cve-2012-1988/Broken Link, Vendor Advisory
- http://secunia.com/advisories/48743Broken Link, Vendor Advisory
- http://secunia.com/advisories/48748Broken Link, Vendor Advisory
- http://secunia.com/advisories/48789Broken Link, Vendor Advisory
- http://secunia.com/advisories/49136Broken Link, Vendor Advisory
- http://ubuntu.com/usn/usn-1419-1Third Party Advisory
- http://www.debian.org/security/2012/dsa-2451Third Party Advisory
- http://www.osvdb.org/81309Broken Link
- http://www.securityfocus.com/bid/52975Broken Link, Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74796Third Party Advisory, VDB Entry
- https://hermes.opensuse.org/messages/14523305Broken Link
- https://hermes.opensuse.org/messages/15087408Broken Link
Timeline
- Published
- May 29, 2012
- Last modified
- Jun 16, 2026
- NVD status
- Modified