Puppet supports use of IP addresses in certnames without warning of potential risks

BASSO 2.6CVE-2012-3408 · GHSA-vxf6-w9mp-95hm · Published 06/08/2012 · updated 16/06/2026

Package	Affected versions	Patched versions
puppet RubyGems	`< 2.7.18`	`2.7.18`
puppet enterprise puppet	`< 2.5.2`	`2.5.2`
puppet puppetlabs	`< 2.7.18`	`2.7.18`

Description

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

NVD description

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

References

nvd.nist.gov/vuln/detail/CVE-2012-3408 · ADVISORY
puppetlabs/puppet commit ab9150b · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
puppetlabs/puppet · PACKAGE
rubysec/ruby-advisory-db · WEB
puppet.com/security/cve/cve-2012-3408-agent-impersonation · WEB
puppetlabs.com/security/cve/cve-2012-3408 · WEB
puppetlabs.com/security/cve/cve-2012-3408 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free