CVE-2012-1988

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise
(PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote
authenticated users with agent SSL keys and file-creation permissions on
the puppet master to execute arbitrary commands by creating a file whose
full pathname contains shell metacharacters, then performing a filebucket
request.

Bugs

• <https://bugs.launchpad.net/bugs/978708&gt;