CVE-2012-1987: puppet
Vulnerability summary
CVE-2012-1987 is a low (CVSS 3.5) vulnerability in puppet. EPSS estimates a 2.52% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 29-05-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.52%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
-0.03 pp
From 2.55% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Puppet2 products
- puppet≥ 2.6.0, < 2.6.15 | ≥ 2.7.0, < 2.7.13
- puppet_enterprise≥ 1.0, < 2.5.1
Debian1 product
- puppet< 2.7.13-1
RubyGems1 product
- puppet≥ 2.6.0, < 2.6.15 | ≥ 2.7.0, < 2.7.13
3 vendors · 4 products
References
31 links- lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.htmlVendor AdvisoryX Refsource FEDORABroken LinkWEB
- lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.htmlVendor AdvisoryX Refsource FEDORABroken LinkWEB
Show all 31 references
- lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.htmlVendor AdvisoryX Refsource FEDORABroken LinkWEB
www.debian.org/security/2012/dsa-2451Vendor AdvisoryX Refsource DEBIANMailing ListThird Party AdvisoryWEB
- github.com/puppetlabs/puppetPACKAGE