2.6

CVE-2012-3408

Exploit

EPSS 0.26%
Published 06.08.2012 16:55:05
Last modified 11.04.2025 00:51:21
Source secalert@redhat.com
Teams watchlist Login
Open Login

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

Affected products Warnungen 0 Metrics 2 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Puppet ≫ Puppet Enterprise Version < 2.5.2

Puppetlabs ≫ Puppet Version < 2.7.18

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.26%	0.462

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	2.6	4.9	2.9	AV:N/AC:H/Au:N/C:P/I:N/A:N

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://puppetlabs.com/security/cve/cve-2012-3408/

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=839166

Third Party Advisory

https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd

Patch

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2012-3408

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2012-3408

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2012-3408

EUVD