CVE-2012-1988 | BDVDB-2026-50370 Detail
Description#
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.osvdb.org/81309
- http://ubuntu.com/usn/usn-1419-1
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html
- http://puppetlabs.com/security/cve/cve-2012-1988/
- http://projects.puppetlabs.com/issues/13518
- https://hermes.opensuse.org/messages/14523305
- http://secunia.com/advisories/48743
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
- https://exchange.xforce.ibmcloud.com/vulnerabilities/74796
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html
- http://secunia.com/advisories/49136
- http://www.securityfocus.com/bid/52975
- http://secunia.com/advisories/48748
- http://www.debian.org/security/2012/dsa-2451
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.