GoogleOSV:GHSA-Q44R-F2HM-V76VPupper does not properly restrict characters in Common Name field of Certificate Signing Request
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.008 Low
EPSS
Percentile
81.7%
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
References
lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
puppetlabs.com/security/cve/cve-2012-3867
www.debian.org/security/2012/dsa-2511
www.ubuntu.com/usn/USN-1506-1
bugzilla.redhat.com/show_bug.cgi?id=839158
github.com/puppetlabs/puppet
github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640
github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50
github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3867.yml
nvd.nist.gov/vuln/detail/CVE-2012-3867
www.puppet.com/security/cve/cve-2012-3867-insufficient-input-validation
Related
4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.008 Low
EPSS
Percentile
81.7%