CVE-2012-3408 Puppet supports use of IP addresses in certnames without warning of potential risks
LowCVSS 2.6
EPSS 1.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | < 2.7.18 | 2.7.18 |
| rubygems puppet(RubyGems) | = 0.13.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.13.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.13.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.13.6 | No fix listed |
| rubygems puppet(RubyGems) | = 0.16.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.18.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.22.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.23.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.23.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.23.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.3 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.5 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.6 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.7 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.8 | No fix listed |
| rubygems puppet(RubyGems) | = 0.24.9 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.0 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.1 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.2 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.3 | No fix listed |
Show 38 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | = 0.25.4 | No fix listed |
| rubygems puppet(RubyGems) | = 0.25.5 | No fix listed |
| rubygems puppet(RubyGems) | = 0.9.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.0 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.10 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.14 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.15 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.16 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.17 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.18 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.2 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.7 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.6.9 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.14 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.16 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.17 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.9 | No fix listed |
| debian/puppet(Debian:11) | < 2.7.18-1 | 2.7.18-1 |
| puppet enterprise | < 2.5.2 | 2.5.2 |
| puppetlabs puppet | < 2.7.18 | 2.7.18 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch third-party-advisory
- bugzilla.redhat.com third-party-advisory
- puppetlabs.com vendor-advisory
- github.com exploit
- www.puppet.com
- github.com
- github.com product
- security-tracker.debian.org vendor-advisory