puppet - several

2012-07-1200:00:00

Google

osv.dev

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

Several security vulnerabilities have been found in Puppet, a
centralized configuration management:

CVE-2012-3864
Authenticated clients could read arbitrary files on the puppet
master.
CVE-2012-3865
Authenticated clients could delete arbitrary files on the puppet
master.
CVE-2012-3866
The report of the most recent Puppet run was stored with world readable
permissions, resulting in information disclosure.
CVE-2012-3867
Agent hostnames were insufficiently validated.

For the stable distribution (squeeze), this problem has been fixed in
version 2.6.2-5+squeeze6.

For the unstable distribution (sid), this problem has been fixed in
version 2.7.18-1.

We recommend that you upgrade your puppet packages.

CPENameOperatorVersion
puppeteq2.6.2-5+squeeze3
puppeteq2.6.2-5+squeeze5
puppeteq2.6.2-5
puppeteq2.6.2-5+squeeze1
puppeteq2.6.2-5+squeeze4
puppeteq2.6.2-4