CVE-2012-3408 | BDVDB-2026-51368 Detail

Description#

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://bugzilla.redhat.com/show_bug.cgi?id=839166
http://puppetlabs.com/security/cve/cve-2012-3408/
https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd

Exploit#

No public exploit known

History#

Version 12012-08-06Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.