CVE-2012-3866

Puppet 2.7.x < 2.7.18 & Puppet Enterprise < 2.5.2 - Sensitive Config Exposure via last_run_report.yaml

Title source: llm
STIX 2.1

Description

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

References (7)

Core 7
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2012/dsa-2511
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1506-1
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50014
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
Vendor Advisory x_refsource_confirm
http://puppetlabs.com/security/cve/cve-2012-3866/
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=839135

Scores

EPSS 0.0005
EPSS Percentile 15.8%

Details

CWE
CWE-264
Status published
Products (18)
puppet/puppet 2.7.2
puppet/puppet 2.7.3
puppet/puppet 2.7.4
puppet/puppet 2.7.5
puppet/puppet 2.7.6
puppet/puppet 2.7.8
puppet/puppet 2.7.9
puppet/puppet 2.7.10
puppet/puppet 2.7.11
puppet/puppet 2.7.12
... and 8 more
Published Aug 06, 2012
Tracked Since Feb 18, 2026