CVE-2012-3866 Puppet allows local users to obtain sensitive configuration information
LowCVSS 2.1
EPSS 0.48%
- Published
- Updated
- Exploit status
- No public exploit known
Description
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems puppet(RubyGems) | >= 2.7.0, < 2.7.18 | 2.7.18 |
| rubygems puppet(RubyGems) | = 2.7.1 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.11 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.12 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.13 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.14 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.16 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.17 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.3 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.4 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.5 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.6 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.8 | No fix listed |
| rubygems puppet(RubyGems) | = 2.7.9 | No fix listed |
| debian/puppet(Debian:11) | < 2.7.18-1 | 2.7.18-1 |
| puppet | = 2.7.2 | No fix listed |
| puppet | = 2.7.3 | No fix listed |
| puppet | = 2.7.4 | No fix listed |
| puppet | = 2.7.5 | No fix listed |
| puppet | = 2.7.6 | No fix listed |
| puppet | = 2.7.8 | No fix listed |
| puppet | = 2.7.9 | No fix listed |
| puppet | = 2.7.10 | No fix listed |
| puppet | = 2.7.11 | No fix listed |
| puppet | = 2.7.12 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| puppet | = 2.7.13 | No fix listed |
| puppet | = 2.7.14 | No fix listed |
| puppet | = 2.7.16 | No fix listed |
| puppetlabs puppet | <= 2.7.17 | No fix listed |
| puppetlabs puppet | = 2.7.0 | No fix listed |
| puppetlabs puppet | = 2.7.1 | No fix listed |
| puppet enterprise | <= 2.5.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit patch
- bugzilla.redhat.com
- openSUSE-SU-2012:0891 vendor-advisory
- puppetlabs.com vendor-advisory
- DSA-2511 vendor-advisory
- USN-1506-1 vendor-advisory
- github.com exploit
- www.puppet.com
- github.com
- github.com product
- security-tracker.debian.org vendor-advisory
- 50014 third-party-advisory