CVE-2012-1988: Command Injection
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1988?
CVE-2012-1988 is rated as a critical vulnerability allowing remote authenticated users to execute arbitrary commands.
How do I fix CVE-2012-1988?
To fix CVE-2012-1988, update Puppet to versions 2.6.15, 2.7.13, or later.
What systems are affected by CVE-2012-1988?
CVE-2012-1988 affects Puppet versions 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, as well as Puppet Enterprise users versions 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1.
Who can exploit CVE-2012-1988?
Remote authenticated users with agent SSL keys and file-creation permissions on the puppet master can exploit CVE-2012-1988.
What type of vulnerability is CVE-2012-1988?
CVE-2012-1988 is categorized as a command injection vulnerability.