CVE-2012-3865: Path Traversal
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Other sources
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
— MITRE
From puppet labs: CVE-2012-3865 (Arbitrary file delete/D.O.S on Puppet Master)
A bug in Puppet 2.6.16 and 2.7.17 allows authenticated clients to delete arbitrary files on the puppet master.
Given a Puppet master with the “Delete” method allowed in auth.conf for an authenticated host, an attacker on that host can send a specially crafted Delete request that can cause an arbitrary file deletion on the Puppet master, potentially causing a denial of service attack. Note that this vulnerability does not exist in Puppet as configured by default; auth.conf must first be edited to enable deletion.
Resolved in Puppet 2.6.17, 2.7.18
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3865?
CVE-2012-3865 is rated as a high severity vulnerability due to its potential for remote authenticated users to delete arbitrary files.
How do I fix CVE-2012-3865?
To remediate CVE-2012-3865, you should upgrade Puppet to version 2.6.17 or 2.7.18 or later versions.
Which versions of Puppet are affected by CVE-2012-3865?
CVE-2012-3865 affects Puppet versions prior to 2.6.17, 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2.
What type of vulnerability is CVE-2012-3865?
CVE-2012-3865 is a directory traversal vulnerability that allows unauthorized file deletion on the Puppet master.
Who is at risk from CVE-2012-3865?
Users of affected Puppet versions, especially those with Delete enabled in auth.conf, are at risk of exploitation.