CVE-2012-1988

N/A Unknown

Published: May 29, 2012 Modified: April 29, 2026

Description

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html

Source: cve@mitre.org

Mailing List Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html

Source: cve@mitre.org

Mailing List Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html

Source: cve@mitre.org

Mailing List Third Party Advisory

http://projects.puppetlabs.com/issues/13518

Source: cve@mitre.org

Broken Link Vendor Advisory

http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15

Source: cve@mitre.org

Broken Link

http://puppetlabs.com/security/cve/cve-2012-1988/

Source: cve@mitre.org

Broken Link Vendor Advisory

http://secunia.com/advisories/48743

Source: cve@mitre.org

Broken Link Vendor Advisory

http://secunia.com/advisories/48748

Source: cve@mitre.org

Broken Link Vendor Advisory

http://secunia.com/advisories/48789

Source: cve@mitre.org

Broken Link Vendor Advisory

http://secunia.com/advisories/49136

Source: cve@mitre.org

Broken Link Vendor Advisory

http://ubuntu.com/usn/usn-1419-1

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2012/dsa-2451

Source: cve@mitre.org

Third Party Advisory

http://www.osvdb.org/81309

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/bid/52975

Source: cve@mitre.org

Broken Link Third Party Advisory VDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/74796

Source: cve@mitre.org

Third Party Advisory VDB Entry

https://hermes.opensuse.org/messages/14523305

Source: cve@mitre.org

Broken Link

https://hermes.opensuse.org/messages/15087408

Source: cve@mitre.org

Broken Link

http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html