Unscored severity · published May 29, 2012
CVE-2012-1988
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent…
–
CVSS
2.6%
EPSS
No
On KEV
Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
6.0; 7.0 · source: NVD
FE
Fedora · Fedoraproject
15; 16; 17 · source: NVD
PU
Puppet · Puppet
2.6.0 before 2.6.15; 2.7.0 before 2.7.13 · source: NVD
PE
Puppet Enterprise · Puppet
1.2.0 before 2.5.1; 1.0; 1.1 · source: NVD
UL
Ubuntu Linux · Canonical
10.04; 11.04; 11.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1988
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html
Mailing List
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html
Broken Link
http://projects.puppetlabs.com/issues/13518
Broken Link
http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
Broken Link
http://puppetlabs.com/security/cve/cve-2012-1988/
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation