Search criteria

10 vulnerabilities found for puppet_enterprise_users by puppetlabs

CVE-2012-1986 (GCVE-0-2012-1986)

Vulnerability from nvd – Published: 2012-05-29 20:00 – Updated: 2024-08-06 19:17
VLAI?
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://ubuntu.com/usn/usn-1419-1 vendor-advisoryx_refsource_UBUNTU
http://lists.fedoraproject.org/pipermail/package-… vendor-advisoryx_refsource_FEDORA
http://puppetlabs.com/security/cve/cve-2012-1986/ x_refsource_CONFIRM
https://hermes.opensuse.org/messages/14523305 vendor-advisoryx_refsource_SUSE
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/48743 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/projects/1/wiki/Re… x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-… vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-… vendor-advisoryx_refsource_FEDORA
http://projects.puppetlabs.com/issues/13511 x_refsource_MISC
http://secunia.com/advisories/49136 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/52975 vdb-entryx_refsource_BID
http://secunia.com/advisories/48748 third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2012/dsa-2451 vendor-advisoryx_refsource_DEBIAN
https://hermes.opensuse.org/messages/15087408 vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/48789 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.701Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-1419-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1419-1"
          },
          {
            "name": "FEDORA-2012-5999",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
          },
          {
            "name": "openSUSE-SU-2012:0608",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/14523305"
          },
          {
            "name": "puppet-rest-symlink(74794)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
          },
          {
            "name": "48743",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48743"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
          },
          {
            "name": "FEDORA-2012-6055",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
          },
          {
            "name": "FEDORA-2012-6674",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13511"
          },
          {
            "name": "49136",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49136"
          },
          {
            "name": "52975",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52975"
          },
          {
            "name": "48748",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48748"
          },
          {
            "name": "DSA-2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2451"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          },
          {
            "name": "48789",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-1419-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1419-1"
        },
        {
          "name": "FEDORA-2012-5999",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
        },
        {
          "name": "openSUSE-SU-2012:0608",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/14523305"
        },
        {
          "name": "puppet-rest-symlink(74794)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
        },
        {
          "name": "48743",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48743"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
        },
        {
          "name": "FEDORA-2012-6055",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
        },
        {
          "name": "FEDORA-2012-6674",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13511"
        },
        {
          "name": "49136",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49136"
        },
        {
          "name": "52975",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52975"
        },
        {
          "name": "48748",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48748"
        },
        {
          "name": "DSA-2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2451"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        },
        {
          "name": "48789",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48789"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1986",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-1419-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1419-1"
            },
            {
              "name": "FEDORA-2012-5999",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1986/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
            },
            {
              "name": "openSUSE-SU-2012:0608",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/14523305"
            },
            {
              "name": "puppet-rest-symlink(74794)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
            },
            {
              "name": "48743",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48743"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
            },
            {
              "name": "FEDORA-2012-6055",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
            },
            {
              "name": "FEDORA-2012-6674",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/13511",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13511"
            },
            {
              "name": "49136",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49136"
            },
            {
              "name": "52975",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52975"
            },
            {
              "name": "48748",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48748"
            },
            {
              "name": "DSA-2451",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2451"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            },
            {
              "name": "48789",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48789"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1986",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-04-02T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1906 (GCVE-0-2012-1906)

Vulnerability from nvd – Published: 2012-05-29 20:00 – Updated: 2024-08-06 19:17
VLAI?
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://projects.puppetlabs.com/issues/13260 x_refsource_MISC
http://ubuntu.com/usn/usn-1419-1 vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/48743 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://puppetlabs.com/security/cve/cve-2012-1906/ x_refsource_CONFIRM
http://www.securityfocus.com/bid/52975 vdb-entryx_refsource_BID
http://secunia.com/advisories/48748 third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2012/dsa-2451 vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/48789 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13260"
          },
          {
            "name": "USN-1419-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1419-1"
          },
          {
            "name": "48743",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48743"
          },
          {
            "name": "puppet-macosx-symlink(74793)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
          },
          {
            "name": "52975",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52975"
          },
          {
            "name": "48748",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48748"
          },
          {
            "name": "DSA-2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2451"
          },
          {
            "name": "48789",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13260"
        },
        {
          "name": "USN-1419-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1419-1"
        },
        {
          "name": "48743",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48743"
        },
        {
          "name": "puppet-macosx-symlink(74793)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
        },
        {
          "name": "52975",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52975"
        },
        {
          "name": "48748",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48748"
        },
        {
          "name": "DSA-2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2451"
        },
        {
          "name": "48789",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48789"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://projects.puppetlabs.com/issues/13260",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13260"
            },
            {
              "name": "USN-1419-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1419-1"
            },
            {
              "name": "48743",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48743"
            },
            {
              "name": "puppet-macosx-symlink(74793)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1906/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
            },
            {
              "name": "52975",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52975"
            },
            {
              "name": "48748",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48748"
            },
            {
              "name": "DSA-2451",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2451"
            },
            {
              "name": "48789",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48789"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1906",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-03-26T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1054 (GCVE-0-2012-1054)

Vulnerability from nvd – Published: 2012-05-29 20:00 – Updated: 2024-08-06 18:45
VLAI?
Summary
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/48157 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/projects/1/wiki/Re… x_refsource_CONFIRM
http://secunia.com/advisories/48166 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/issues/12460 x_refsource_MISC
http://www.osvdb.org/79496 vdb-entryx_refsource_OSVDB
http://puppetlabs.com/security/cve/cve-2012-1054/ x_refsource_CONFIRM
http://ubuntu.com/usn/usn-1372-1 vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/48290 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/48161 third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/52158 vdb-entryx_refsource_BID
http://www.debian.org/security/2012/dsa-2419 vendor-advisoryx_refsource_DEBIAN
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
https://hermes.opensuse.org/messages/15087408 vendor-advisoryx_refsource_SUSE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:27.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "48157",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48157"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
          },
          {
            "name": "48166",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48166"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12460"
          },
          {
            "name": "79496",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/79496"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
          },
          {
            "name": "USN-1372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1372-1"
          },
          {
            "name": "48290",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48290"
          },
          {
            "name": "48161",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48161"
          },
          {
            "name": "SUSE-SU-2012:0325",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
          },
          {
            "name": "52158",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52158"
          },
          {
            "name": "DSA-2419",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2419"
          },
          {
            "name": "puppet-k5login-type-symlink(73446)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-02-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "48157",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48157"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
        },
        {
          "name": "48166",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48166"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12460"
        },
        {
          "name": "79496",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/79496"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
        },
        {
          "name": "USN-1372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1372-1"
        },
        {
          "name": "48290",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48290"
        },
        {
          "name": "48161",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48161"
        },
        {
          "name": "SUSE-SU-2012:0325",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
        },
        {
          "name": "52158",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52158"
        },
        {
          "name": "DSA-2419",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2419"
        },
        {
          "name": "puppet-k5login-type-symlink(73446)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1054",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "48157",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48157"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
            },
            {
              "name": "48166",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48166"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12460",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12460"
            },
            {
              "name": "79496",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/79496"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1054/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
            },
            {
              "name": "USN-1372-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1372-1"
            },
            {
              "name": "48290",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48290"
            },
            {
              "name": "48161",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48161"
            },
            {
              "name": "SUSE-SU-2012:0325",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
            },
            {
              "name": "52158",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52158"
            },
            {
              "name": "DSA-2419",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2419"
            },
            {
              "name": "puppet-k5login-type-symlink(73446)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1054",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-02-13T00:00:00",
    "dateUpdated": "2024-08-06T18:45:27.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1053 (GCVE-0-2012-1053)

Vulnerability from nvd – Published: 2012-05-29 20:00 – Updated: 2024-08-06 18:45
VLAI?
Summary
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/48157 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/projects/1/wiki/Re… x_refsource_CONFIRM
http://secunia.com/advisories/48166 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/issues/12458 x_refsource_MISC
http://puppetlabs.com/security/cve/cve-2012-1053/ x_refsource_CONFIRM
http://projects.puppetlabs.com/issues/12459 x_refsource_MISC
http://ubuntu.com/usn/usn-1372-1 vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/48290 third-party-advisoryx_refsource_SECUNIA
http://www.osvdb.org/79495 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/48161 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/issues/12457 x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.securityfocus.com/bid/52158 vdb-entryx_refsource_BID
http://www.debian.org/security/2012/dsa-2419 vendor-advisoryx_refsource_DEBIAN
https://hermes.opensuse.org/messages/15087408 vendor-advisoryx_refsource_SUSE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:26.804Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "48157",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48157"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
          },
          {
            "name": "48166",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48166"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12458"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12459"
          },
          {
            "name": "USN-1372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1372-1"
          },
          {
            "name": "48290",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48290"
          },
          {
            "name": "79495",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/79495"
          },
          {
            "name": "48161",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12457"
          },
          {
            "name": "SUSE-SU-2012:0325",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
          },
          {
            "name": "puppet-forked-priv-escalation(73445)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
          },
          {
            "name": "52158",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52158"
          },
          {
            "name": "DSA-2419",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2419"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-02-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "48157",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48157"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
        },
        {
          "name": "48166",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48166"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12458"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12459"
        },
        {
          "name": "USN-1372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1372-1"
        },
        {
          "name": "48290",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48290"
        },
        {
          "name": "79495",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/79495"
        },
        {
          "name": "48161",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12457"
        },
        {
          "name": "SUSE-SU-2012:0325",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
        },
        {
          "name": "puppet-forked-priv-escalation(73445)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
        },
        {
          "name": "52158",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52158"
        },
        {
          "name": "DSA-2419",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2419"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1053",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "48157",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48157"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
            },
            {
              "name": "48166",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48166"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12458",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12458"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1053/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12459",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12459"
            },
            {
              "name": "USN-1372-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1372-1"
            },
            {
              "name": "48290",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48290"
            },
            {
              "name": "79495",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/79495"
            },
            {
              "name": "48161",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48161"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12457",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12457"
            },
            {
              "name": "SUSE-SU-2012:0325",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
            },
            {
              "name": "puppet-forked-priv-escalation(73445)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
            },
            {
              "name": "52158",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52158"
            },
            {
              "name": "DSA-2419",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2419"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1053",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-02-13T00:00:00",
    "dateUpdated": "2024-08-06T18:45:26.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-3872 (GCVE-0-2011-3872)

Vulnerability from nvd – Published: 2011-10-27 20:00 – Updated: 2024-08-06 23:53
VLAI?
Summary
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/46550 third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-1238-2 vendor-advisoryx_refsource_UBUNTU
http://puppetlabs.com/blog/important-security-ann… x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/46578 third-party-advisoryx_refsource_SECUNIA
https://puppet.com/security/cve/cve-2011-3872 x_refsource_CONFIRM
http://secunia.com/advisories/46934 third-party-advisoryx_refsource_SECUNIA
http://groups.google.com/group/puppet-announce/br… x_refsource_CONFIRM
http://www.securityfocus.com/bid/50356 vdb-entryx_refsource_BID
http://secunia.com/advisories/46964 third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-1238-1 vendor-advisoryx_refsource_UBUNTU
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:53:31.429Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "46550",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46550"
          },
          {
            "name": "USN-1238-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1238-2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
          },
          {
            "name": "puppet-x509-spoofing(70970)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
          },
          {
            "name": "46578",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46578"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://puppet.com/security/cve/cve-2011-3872"
          },
          {
            "name": "46934",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46934"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
          },
          {
            "name": "50356",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/50356"
          },
          {
            "name": "46964",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46964"
          },
          {
            "name": "USN-1238-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1238-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-10-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master\u0027s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka \"AltNames Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-08T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "46550",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46550"
        },
        {
          "name": "USN-1238-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1238-2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
        },
        {
          "name": "puppet-x509-spoofing(70970)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
        },
        {
          "name": "46578",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46578"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://puppet.com/security/cve/cve-2011-3872"
        },
        {
          "name": "46934",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46934"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
        },
        {
          "name": "50356",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/50356"
        },
        {
          "name": "46964",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46964"
        },
        {
          "name": "USN-1238-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1238-1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-3872",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master\u0027s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka \"AltNames Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "46550",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46550"
            },
            {
              "name": "USN-1238-2",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1238-2"
            },
            {
              "name": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
            },
            {
              "name": "puppet-x509-spoofing(70970)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
            },
            {
              "name": "46578",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46578"
            },
            {
              "name": "https://puppet.com/security/cve/cve-2011-3872",
              "refsource": "CONFIRM",
              "url": "https://puppet.com/security/cve/cve-2011-3872"
            },
            {
              "name": "46934",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46934"
            },
            {
              "name": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1",
              "refsource": "CONFIRM",
              "url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
            },
            {
              "name": "50356",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/50356"
            },
            {
              "name": "46964",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46964"
            },
            {
              "name": "USN-1238-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1238-1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-3872",
    "datePublished": "2011-10-27T20:00:00",
    "dateReserved": "2011-09-29T00:00:00",
    "dateUpdated": "2024-08-06T23:53:31.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1906 (GCVE-0-2012-1906)

Vulnerability from cvelistv5 – Published: 2012-05-29 20:00 – Updated: 2024-08-06 19:17
VLAI?
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://projects.puppetlabs.com/issues/13260 x_refsource_MISC
http://ubuntu.com/usn/usn-1419-1 vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/48743 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://puppetlabs.com/security/cve/cve-2012-1906/ x_refsource_CONFIRM
http://www.securityfocus.com/bid/52975 vdb-entryx_refsource_BID
http://secunia.com/advisories/48748 third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2012/dsa-2451 vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/48789 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.063Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13260"
          },
          {
            "name": "USN-1419-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1419-1"
          },
          {
            "name": "48743",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48743"
          },
          {
            "name": "puppet-macosx-symlink(74793)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
          },
          {
            "name": "52975",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52975"
          },
          {
            "name": "48748",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48748"
          },
          {
            "name": "DSA-2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2451"
          },
          {
            "name": "48789",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13260"
        },
        {
          "name": "USN-1419-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1419-1"
        },
        {
          "name": "48743",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48743"
        },
        {
          "name": "puppet-macosx-symlink(74793)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
        },
        {
          "name": "52975",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52975"
        },
        {
          "name": "48748",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48748"
        },
        {
          "name": "DSA-2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2451"
        },
        {
          "name": "48789",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48789"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1906",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://projects.puppetlabs.com/issues/13260",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13260"
            },
            {
              "name": "USN-1419-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1419-1"
            },
            {
              "name": "48743",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48743"
            },
            {
              "name": "puppet-macosx-symlink(74793)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74793"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1906/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1906/"
            },
            {
              "name": "52975",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52975"
            },
            {
              "name": "48748",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48748"
            },
            {
              "name": "DSA-2451",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2451"
            },
            {
              "name": "48789",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48789"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1906",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-03-26T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.063Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1053 (GCVE-0-2012-1053)

Vulnerability from cvelistv5 – Published: 2012-05-29 20:00 – Updated: 2024-08-06 18:45
VLAI?
Summary
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/48157 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/projects/1/wiki/Re… x_refsource_CONFIRM
http://secunia.com/advisories/48166 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/issues/12458 x_refsource_MISC
http://puppetlabs.com/security/cve/cve-2012-1053/ x_refsource_CONFIRM
http://projects.puppetlabs.com/issues/12459 x_refsource_MISC
http://ubuntu.com/usn/usn-1372-1 vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/48290 third-party-advisoryx_refsource_SECUNIA
http://www.osvdb.org/79495 vdb-entryx_refsource_OSVDB
http://secunia.com/advisories/48161 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/issues/12457 x_refsource_MISC
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.securityfocus.com/bid/52158 vdb-entryx_refsource_BID
http://www.debian.org/security/2012/dsa-2419 vendor-advisoryx_refsource_DEBIAN
https://hermes.opensuse.org/messages/15087408 vendor-advisoryx_refsource_SUSE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:26.804Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "48157",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48157"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
          },
          {
            "name": "48166",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48166"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12458"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12459"
          },
          {
            "name": "USN-1372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1372-1"
          },
          {
            "name": "48290",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48290"
          },
          {
            "name": "79495",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/79495"
          },
          {
            "name": "48161",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48161"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12457"
          },
          {
            "name": "SUSE-SU-2012:0325",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
          },
          {
            "name": "puppet-forked-priv-escalation(73445)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
          },
          {
            "name": "52158",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52158"
          },
          {
            "name": "DSA-2419",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2419"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-02-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "48157",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48157"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
        },
        {
          "name": "48166",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48166"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12458"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12459"
        },
        {
          "name": "USN-1372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1372-1"
        },
        {
          "name": "48290",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48290"
        },
        {
          "name": "79495",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/79495"
        },
        {
          "name": "48161",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48161"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12457"
        },
        {
          "name": "SUSE-SU-2012:0325",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
        },
        {
          "name": "puppet-forked-priv-escalation(73445)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
        },
        {
          "name": "52158",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52158"
        },
        {
          "name": "DSA-2419",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2419"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1053",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "48157",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48157"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
            },
            {
              "name": "48166",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48166"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12458",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12458"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1053/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1053/"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12459",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12459"
            },
            {
              "name": "USN-1372-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1372-1"
            },
            {
              "name": "48290",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48290"
            },
            {
              "name": "79495",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/79495"
            },
            {
              "name": "48161",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48161"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12457",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12457"
            },
            {
              "name": "SUSE-SU-2012:0325",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
            },
            {
              "name": "puppet-forked-priv-escalation(73445)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73445"
            },
            {
              "name": "52158",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52158"
            },
            {
              "name": "DSA-2419",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2419"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1053",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-02-13T00:00:00",
    "dateUpdated": "2024-08-06T18:45:26.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1986 (GCVE-0-2012-1986)

Vulnerability from cvelistv5 – Published: 2012-05-29 20:00 – Updated: 2024-08-06 19:17
VLAI?
Summary
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://ubuntu.com/usn/usn-1419-1 vendor-advisoryx_refsource_UBUNTU
http://lists.fedoraproject.org/pipermail/package-… vendor-advisoryx_refsource_FEDORA
http://puppetlabs.com/security/cve/cve-2012-1986/ x_refsource_CONFIRM
https://hermes.opensuse.org/messages/14523305 vendor-advisoryx_refsource_SUSE
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/48743 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/projects/1/wiki/Re… x_refsource_CONFIRM
http://lists.fedoraproject.org/pipermail/package-… vendor-advisoryx_refsource_FEDORA
http://lists.fedoraproject.org/pipermail/package-… vendor-advisoryx_refsource_FEDORA
http://projects.puppetlabs.com/issues/13511 x_refsource_MISC
http://secunia.com/advisories/49136 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/52975 vdb-entryx_refsource_BID
http://secunia.com/advisories/48748 third-party-advisoryx_refsource_SECUNIA
http://www.debian.org/security/2012/dsa-2451 vendor-advisoryx_refsource_DEBIAN
https://hermes.opensuse.org/messages/15087408 vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/48789 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.701Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-1419-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1419-1"
          },
          {
            "name": "FEDORA-2012-5999",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
          },
          {
            "name": "openSUSE-SU-2012:0608",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/14523305"
          },
          {
            "name": "puppet-rest-symlink(74794)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
          },
          {
            "name": "48743",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48743"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
          },
          {
            "name": "FEDORA-2012-6055",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
          },
          {
            "name": "FEDORA-2012-6674",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13511"
          },
          {
            "name": "49136",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49136"
          },
          {
            "name": "52975",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52975"
          },
          {
            "name": "48748",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48748"
          },
          {
            "name": "DSA-2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2451"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          },
          {
            "name": "48789",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-1419-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1419-1"
        },
        {
          "name": "FEDORA-2012-5999",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
        },
        {
          "name": "openSUSE-SU-2012:0608",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/14523305"
        },
        {
          "name": "puppet-rest-symlink(74794)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
        },
        {
          "name": "48743",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48743"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
        },
        {
          "name": "FEDORA-2012-6055",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
        },
        {
          "name": "FEDORA-2012-6674",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13511"
        },
        {
          "name": "49136",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49136"
        },
        {
          "name": "52975",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52975"
        },
        {
          "name": "48748",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48748"
        },
        {
          "name": "DSA-2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2451"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        },
        {
          "name": "48789",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48789"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1986",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-1419-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1419-1"
            },
            {
              "name": "FEDORA-2012-5999",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1986/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
            },
            {
              "name": "openSUSE-SU-2012:0608",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/14523305"
            },
            {
              "name": "puppet-rest-symlink(74794)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
            },
            {
              "name": "48743",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48743"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
            },
            {
              "name": "FEDORA-2012-6055",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
            },
            {
              "name": "FEDORA-2012-6674",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/13511",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13511"
            },
            {
              "name": "49136",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49136"
            },
            {
              "name": "52975",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52975"
            },
            {
              "name": "48748",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48748"
            },
            {
              "name": "DSA-2451",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2451"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            },
            {
              "name": "48789",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48789"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1986",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-04-02T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1054 (GCVE-0-2012-1054)

Vulnerability from cvelistv5 – Published: 2012-05-29 20:00 – Updated: 2024-08-06 18:45
VLAI?
Summary
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/48157 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/projects/1/wiki/Re… x_refsource_CONFIRM
http://secunia.com/advisories/48166 third-party-advisoryx_refsource_SECUNIA
http://projects.puppetlabs.com/issues/12460 x_refsource_MISC
http://www.osvdb.org/79496 vdb-entryx_refsource_OSVDB
http://puppetlabs.com/security/cve/cve-2012-1054/ x_refsource_CONFIRM
http://ubuntu.com/usn/usn-1372-1 vendor-advisoryx_refsource_UBUNTU
http://secunia.com/advisories/48290 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/48161 third-party-advisoryx_refsource_SECUNIA
http://lists.opensuse.org/opensuse-security-annou… vendor-advisoryx_refsource_SUSE
http://www.securityfocus.com/bid/52158 vdb-entryx_refsource_BID
http://www.debian.org/security/2012/dsa-2419 vendor-advisoryx_refsource_DEBIAN
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
https://hermes.opensuse.org/messages/15087408 vendor-advisoryx_refsource_SUSE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:27.072Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "48157",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48157"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
          },
          {
            "name": "48166",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48166"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/12460"
          },
          {
            "name": "79496",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/79496"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
          },
          {
            "name": "USN-1372-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1372-1"
          },
          {
            "name": "48290",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48290"
          },
          {
            "name": "48161",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48161"
          },
          {
            "name": "SUSE-SU-2012:0325",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
          },
          {
            "name": "52158",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52158"
          },
          {
            "name": "DSA-2419",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2419"
          },
          {
            "name": "puppet-k5login-type-symlink(73446)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-02-22T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "48157",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48157"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
        },
        {
          "name": "48166",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48166"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/12460"
        },
        {
          "name": "79496",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/79496"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
        },
        {
          "name": "USN-1372-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1372-1"
        },
        {
          "name": "48290",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48290"
        },
        {
          "name": "48161",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48161"
        },
        {
          "name": "SUSE-SU-2012:0325",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
        },
        {
          "name": "52158",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52158"
        },
        {
          "name": "DSA-2419",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2419"
        },
        {
          "name": "puppet-k5login-type-symlink(73446)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1054",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "48157",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48157"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14"
            },
            {
              "name": "48166",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48166"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/12460",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/12460"
            },
            {
              "name": "79496",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/79496"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1054/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1054/"
            },
            {
              "name": "USN-1372-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1372-1"
            },
            {
              "name": "48290",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48290"
            },
            {
              "name": "48161",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48161"
            },
            {
              "name": "SUSE-SU-2012:0325",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html"
            },
            {
              "name": "52158",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52158"
            },
            {
              "name": "DSA-2419",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2419"
            },
            {
              "name": "puppet-k5login-type-symlink(73446)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73446"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1054",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-02-13T00:00:00",
    "dateUpdated": "2024-08-06T18:45:27.072Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-3872 (GCVE-0-2011-3872)

Vulnerability from cvelistv5 – Published: 2011-10-27 20:00 – Updated: 2024-08-06 23:53
VLAI?
Summary
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://secunia.com/advisories/46550 third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-1238-2 vendor-advisoryx_refsource_UBUNTU
http://puppetlabs.com/blog/important-security-ann… x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://secunia.com/advisories/46578 third-party-advisoryx_refsource_SECUNIA
https://puppet.com/security/cve/cve-2011-3872 x_refsource_CONFIRM
http://secunia.com/advisories/46934 third-party-advisoryx_refsource_SECUNIA
http://groups.google.com/group/puppet-announce/br… x_refsource_CONFIRM
http://www.securityfocus.com/bid/50356 vdb-entryx_refsource_BID
http://secunia.com/advisories/46964 third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-1238-1 vendor-advisoryx_refsource_UBUNTU
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T23:53:31.429Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "46550",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46550"
          },
          {
            "name": "USN-1238-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1238-2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
          },
          {
            "name": "puppet-x509-spoofing(70970)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
          },
          {
            "name": "46578",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46578"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://puppet.com/security/cve/cve-2011-3872"
          },
          {
            "name": "46934",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46934"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
          },
          {
            "name": "50356",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/50356"
          },
          {
            "name": "46964",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/46964"
          },
          {
            "name": "USN-1238-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1238-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-10-24T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master\u0027s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka \"AltNames Vulnerability.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-12-08T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "46550",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46550"
        },
        {
          "name": "USN-1238-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1238-2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
        },
        {
          "name": "puppet-x509-spoofing(70970)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
        },
        {
          "name": "46578",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46578"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://puppet.com/security/cve/cve-2011-3872"
        },
        {
          "name": "46934",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46934"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
        },
        {
          "name": "50356",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/50356"
        },
        {
          "name": "46964",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/46964"
        },
        {
          "name": "USN-1238-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1238-1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-3872",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master\u0027s certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka \"AltNames Vulnerability.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "46550",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46550"
            },
            {
              "name": "USN-1238-2",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1238-2"
            },
            {
              "name": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/"
            },
            {
              "name": "puppet-x509-spoofing(70970)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70970"
            },
            {
              "name": "46578",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46578"
            },
            {
              "name": "https://puppet.com/security/cve/cve-2011-3872",
              "refsource": "CONFIRM",
              "url": "https://puppet.com/security/cve/cve-2011-3872"
            },
            {
              "name": "46934",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46934"
            },
            {
              "name": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1",
              "refsource": "CONFIRM",
              "url": "http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1"
            },
            {
              "name": "50356",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/50356"
            },
            {
              "name": "46964",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/46964"
            },
            {
              "name": "USN-1238-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1238-1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-3872",
    "datePublished": "2011-10-27T20:00:00",
    "dateReserved": "2011-09-29T00:00:00",
    "dateUpdated": "2024-08-06T23:53:31.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}