CVE-2012-1986

2012-04-1100:00:00

ubuntu.com

CVSS2

2.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:S/C:P/I:N/A:N

EPSS

0.002

Percentile

65.0%

JSON

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise
(PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote
authenticated users with an authorized SSL key and certain permissions on
the puppet master to read arbitrary files via a symlink attack in
conjunction with a crafted REST request for a file in a filebucket.

Bugs

<https://bugs.launchpad.net/bugs/978708>

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchpuppet< 0.25.4-2ubuntu6.7UNKNOWN
ubuntu11.04noarchpuppet< 2.6.4-2ubuntu2.9UNKNOWN
ubuntu11.10noarchpuppet< 2.7.1-1ubuntu3.6UNKNOWN