CVE-2012-3864

Description

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.

References

https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87

https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4

https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-3811

https://bugzilla.redhat.com/show_bug.cgi?id=839130

http://www.ubuntu.com/usn/USN-1506-1

http://www.debian.org/security/2012/dsa-2511

http://secunia.com/advisories/50014

http://puppetlabs.com/security/cve/cve-2012-3864/

http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS