Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

puppet puppet 2.6.12 vulnerabilities and exploits

(subscribe to this query)
6.9
CVSSv2
CVE-2012-1053
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x prior to 2.6.14 and 2.7.x prior to 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x prior to 2.0.3 does not properly manage group privileges, which allows local users to gain...
Puppet Puppet 2.6.13Puppet Puppet 2.6.5Puppet Puppet 2.6.4Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.1Puppet Puppet 2.6.0Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.4Puppet Puppet 2.7.3Puppet Puppet 2.7.5Puppet Puppet 2.7.2Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.1
6.5
CVSSv2
CVE-2013-2274
Puppet 2.6.x prior to 2.6.18 and Puppet Enterprise 1.2.x prior to 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
Puppet Puppet 2.6.14Puppet Puppet 2.6.12Puppet Puppet 2.6.1Puppet Puppet 2.6.8Puppet Puppet 2.6.0Puppet Puppet 2.6.15Puppet Puppet 2.6.11Puppet Puppet 2.6.10Puppet Puppet 2.6.5Puppetlabs Puppet 2.6.17Puppet Puppet 2.6.16Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.6.13Puppet Puppet 2.6.9Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet Enterprise 1.2.0
4.4
CVSSv2
CVE-2012-1054
Puppet 2.6.x prior to 2.6.14 and 2.7.x prior to 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x prior to 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
Puppet Puppet 2.6.11Puppet Puppet 2.6.10Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.6.13Puppet Puppet 2.6.12Puppet Puppet 2.6.5Puppet Puppet 2.6.4Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.1Puppet Puppet 2.6.0Puppet Puppet 2.7.10Puppet Puppet 2.7.9Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.7.8Puppet Puppet 2.7.7Puppet Puppet 2.7.3Puppet Puppet 2.7.2
4.3
CVSSv2
CVE-2012-3867
lib/puppet/ssl/certificate_authority.rb in Puppet prior to 2.6.17 and 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted re...
Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.12Puppet Puppet 2.6.13Puppet Puppet 2.7.2Puppet Puppet 2.7.3Puppet Puppet 2.7.4Puppet Puppet 2.7.5Puppet Puppet 2.6.15Puppet Puppet 2.6.10Puppet Puppet 2.6.4Puppet Puppet 2.6.7Puppet Puppet 2.6.5Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.6Puppet Puppet 2.7.8Puppet Puppet 2.7.16Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.6.8Puppet Puppet 2.7.10
4
CVSSv2
CVE-2013-2275
The default configuration for puppet masters 0.25.0 and later in Puppet prior to 2.6.18, 2.7.x prior to 2.7.21, and 3.1.x prior to 3.1.1, and Puppet Enterprise prior to 1.2.7 and 2.7.x prior to 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspeci...
Puppet Puppet 2.6.0Puppet Puppet 2.6.15Puppet Puppet 2.6.16Puppet Puppet 2.6.14Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppetlabs PuppetPuppet Puppet 2.6.12Puppet Puppet 2.6.9Puppet Puppet 2.6.10Puppet Puppet 2.6.8Puppet Puppet 2.6.6Puppet Puppet 2.6.13Puppet Puppet 2.6.11Puppet Puppet 2.6.7Puppet Puppet 2.6.5Puppetlabs Puppet 2.7.19Puppetlabs Puppet 2.7.20Puppet Puppet 2.7.9Puppet Puppet 2.7.4
4
CVSSv2
CVE-2012-3864
Puppet prior to 2.6.17 and 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.
Puppet Puppet 2.6.15Puppetlabs PuppetPuppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.5Puppetlabs Puppet 2.7.0Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.2Puppet Puppet 2.7.10Puppet Puppet 2.7.11Puppet Puppet 2.7.8Puppet Puppet 2.7.9Puppet Puppet 2.7.17Puppet Puppet 2.6.9Puppet Puppet 2.6.10Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.7.6
3.5
CVSSv2
CVE-2012-3865
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet prior to 2.6.17 and 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server...
Puppetlabs PuppetPuppet Puppet 2.7.8Puppet Puppet 2.7.6Puppet Puppet 2.7.11Puppet Puppet 2.7.10Puppet Puppet 2.7.9Puppet Puppet 2.7.2Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.13Puppet Puppet 2.7.12Puppet Puppet 2.7.3Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.16Puppet Puppet 2.7.14Puppet Puppet 2.7.5Puppet Puppet 2.7.4Puppet Puppet 2.6.10Puppet Puppet 2.6.11Puppet Puppet 2.6.5Puppet Puppet 2.6.13Puppet Puppet 2.6.9Puppet Puppet 2.6.8
3.5
CVSSv2
CVE-2012-1987
Unspecified vulnerability in Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a...
Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.13Puppet Puppet 2.6.12Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.11Puppet Puppet 2.6.10Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.1Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.4Puppet Puppet 2.7.3
3.3
CVSSv2
CVE-2012-1906
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or i...
Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.6.13Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.3Puppet Puppet 2.7.11Puppet Puppet 2.7.7Puppet Puppet 2.7.6Puppet Puppet 2.7.5
2.6
CVSSv2
CVE-2011-3872
Puppet 2.6.x prior to 2.6.12 and 2.7.x prior to 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 prior to 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which all...
Puppet Puppet 2.6.1Puppet Puppet 2.6.8Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.6.9Puppet Puppet 2.6.10Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.7.3Puppet Puppet 2.7.5Puppet Puppet 2.6.0Puppet Puppet 2.6.4Puppet Puppet 2.6.5Puppet Puppet 2.6.11Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.7.2Puppetlabs Puppet 2.7.1Puppet Puppet Enterprise 1.2.2Puppet Puppet Enterprise 1.2.3Puppetlabs Puppet Enterprise Users 1.0Puppet Puppet Enterprise 1.2.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2006-4304CVE-2024-4240arbitrary CVE-2024-31601XSSCVE-2023-20198CVE-2024-4256CVE-2024-3342encryption
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook