CVE-2012-1988 Puppet Arbitrary Command Execution
MediumCVSS 6.0
EPSS 2.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | >= 2.6.0, < 2.6.15 | 2.6.15 |
| rubygems puppet(RubyGems) | >= 2.7.0, < 2.7.13 | 2.7.13 |
| rubygems puppet(RubyGems) | = 2.6.0 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.10 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.14 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.7 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.9 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.8 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | = 2.7.9 | No fix listed |
| debian/puppet(Debian:11) | < 2.7.13-1 | 2.7.13-1 |
| puppet | >= 2.6.0, < 2.6.15 | 2.6.15 |
| puppet | >= 2.7.0, < 2.7.13 | 2.7.13 |
| puppet enterprise | >= 1.2.0, < 2.5.1 | 2.5.1 |
| puppet enterprise | = 1.0 | No fix listed |
| puppet enterprise | = 1.1 | No fix listed |
| fedoraproject fedora | = 15 | No fix listed |
| fedoraproject fedora | = 16 | No fix listed |
| fedoraproject fedora | = 17 | No fix listed |
| debian linux | = 6.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.04 | No fix listed |
| Canonical Ubuntu Linux | = 11.10 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- puppet-file-bucket-command-exec(74796) third-party-advisory vdb-entry
- openSUSE-SU-2012:0608 broken-link vendor-advisory
- openSUSE-SU-2012:0835 broken-link vendor-advisory
- FEDORA-2012-5999 mailing-list third-party-advisory vendor-advisory
- FEDORA-2012-6055 mailing-list third-party-advisory vendor-advisory
- FEDORA-2012-6674 mailing-list third-party-advisory vendor-advisory
- USN-1419-1 third-party-advisory vendor-advisory
- DSA-2451 third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- github.com exploit
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- projects.puppetlabs.com broken-link vendor-advisory
- projects.puppetlabs.com broken-link
- puppetlabs.com broken-link vendor-advisory
- github.com
- github.com product
- security-tracker.debian.org vendor-advisory
- 48743 broken-link third-party-advisory vendor-advisory
- 48748 broken-link third-party-advisory vendor-advisory
- 48789 broken-link third-party-advisory vendor-advisory
- 49136 broken-link third-party-advisory vendor-advisory
- 81309 broken-link vdb-entry
- 52975 broken-link third-party-advisory vdb-entry