Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2012-3867

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Published

2012-08-06T16:55:06.680

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-264

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	puppet	puppet	2.6.0	Yes
Application	puppet	puppet	2.6.1	Yes
Application	puppet	puppet	2.6.2	Yes
Application	puppet	puppet	2.6.3	Yes
Application	puppet	puppet	2.6.4	Yes
Application	puppet	puppet	2.6.5	Yes
Application	puppet	puppet	2.6.6	Yes
Application	puppet	puppet	2.6.7	Yes
Application	puppet	puppet	2.6.8	Yes
Application	puppet	puppet	2.6.9	Yes
Application	puppet	puppet	2.6.10	Yes
Application	puppet	puppet	2.6.11	Yes
Application	puppet	puppet	2.6.12	Yes
Application	puppet	puppet	2.6.13	Yes
Application	puppet	puppet	2.6.14	Yes
Application	puppet	puppet	2.6.15	Yes
Application	puppet	puppet	2.7.2	Yes
Application	puppet	puppet	2.7.3	Yes
Application	puppet	puppet	2.7.4	Yes
Application	puppet	puppet	2.7.5	Yes
Application	puppet	puppet	2.7.6	Yes
Application	puppet	puppet	2.7.7	Yes
Application	puppet	puppet	2.7.8	Yes
Application	puppet	puppet	2.7.9	Yes
Application	puppet	puppet	2.7.10	Yes
Application	puppet	puppet	2.7.11	Yes
Application	puppet	puppet	2.7.12	Yes
Application	puppet	puppet	2.7.13	Yes
Application	puppet	puppet	2.7.14	Yes
Application	puppet	puppet	2.7.16	Yes
Application	puppet	puppet	2.7.17	Yes
Application	puppetlabs	puppet	≤ 2.6.16	Yes
Application	puppetlabs	puppet	2.7.0	Yes
Application	puppetlabs	puppet	2.7.1	Yes
Operating System	debian	debian_linux	6.0	Yes
Operating System	canonical	ubuntu_linux	10.04	Yes
Operating System	canonical	ubuntu_linux	11.04	Yes
Operating System	canonical	ubuntu_linux	11.10	Yes
Operating System	canonical	ubuntu_linux	12.04	Yes
Operating System	opensuse	opensuse	11.4	Yes
Operating System	opensuse	opensuse	12.1	Yes
Operating System	suse	linux_enterprise_desktop	11	Yes
Operating System	suse	linux_enterprise_desktop	11	Yes
Operating System	suse	linux_enterprise_server	11	Yes
Operating System	suse	linux_enterprise_server	11	Yes
Operating System	suse	linux_enterprise_server	11	Yes
Application	puppet	puppet_enterprise	≤ 2.5.1	Yes

References

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html Third Party Advisory ([email protected])
http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html Third Party Advisory ([email protected])
http://puppetlabs.com/security/cve/cve-2012-3867/ Vendor Advisory ([email protected])
http://secunia.com/advisories/50014 ([email protected])
http://www.debian.org/security/2012/dsa-2511 Third Party Advisory ([email protected])
http://www.ubuntu.com/usn/USN-1506-1 Third Party Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=839158 Issue Tracking ([email protected])
https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 Exploit, Issue Tracking, Patch ([email protected])
https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 Exploit, Issue Tracking, Patch ([email protected])
http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://puppetlabs.com/security/cve/cve-2012-3867/ Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/50014 (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2012/dsa-2511 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-1506-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=839158 Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 Exploit, Issue Tracking, Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 Exploit, Issue Tracking, Patch (af854a3a-2127-422b-91ae-364da2661108)