Puppet supports use of IP addresses in certnames without warning of potential risks

THẤP 2.6CVE-2012-3408 · GHSA-vxf6-w9mp-95hm · Công bố 06/08/2012 · cập nhật 16/06/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
puppet RubyGems	`< 2.7.18`	`2.7.18`
puppet enterprise puppet	`< 2.5.2`	`2.5.2`
puppet puppetlabs	`< 2.7.18`	`2.7.18`

Mô tả

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

Mô tả của NVD

lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

Tham khảo

nvd.nist.gov/vuln/detail/CVE-2012-3408 · ADVISORY
puppetlabs/puppet commit ab9150b · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
puppetlabs/puppet · PACKAGE
rubysec/ruby-advisory-db · WEB
puppet.com/security/cve/cve-2012-3408-agent-impersonation · WEB
puppetlabs.com/security/cve/cve-2012-3408 · WEB
puppetlabs.com/security/cve/cve-2012-3408 · Vendor Advisory

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí