GHSA-q44r-f2hm-v76v
Suggest an improvement- Source
- https://github.com/advisories/GHSA-q44r-f2hm-v76v
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-q44r-f2hm-v76v/GHSA-q44r-f2hm-v76v.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-q44r-f2hm-v76v
- Aliases
- Published
- 2017-10-24T18:33:37Z
- Modified
- 2024-02-15T05:34:09.787326Z
- Summary
- Pupper does not properly restrict characters in Common Name field of Certificate Signing Request
- Details
-
lib/puppet/ssl/certificate_authority.rbin Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2012-3867
- https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640
- https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50
- https://bugzilla.redhat.com/show_bug.cgi?id=839158
- https://github.com/puppetlabs/puppet
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3867.yml
- https://www.puppet.com/security/cve/cve-2012-3867-insufficient-input-validation
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
- http://puppetlabs.com/security/cve/cve-2012-3867
- http://www.debian.org/security/2012/dsa-2511
- http://www.ubuntu.com/usn/USN-1506-1
Affected packages
RubyGems / puppet
Package
- Name
- puppet
- Purl
- pkg:gem/puppet
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.6.17
Affected versions
0.*
0.9.2
0.13.0
0.13.1
0.13.2
0.13.6
0.16.0
0.18.4
0.22.4
0.23.0
0.23.1
0.23.2
0.24.0
0.24.1
0.24.2
0.24.3
0.24.4
0.24.5
0.24.6
0.24.7
0.24.8
0.24.9
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
2.*
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.6.10
2.6.11
2.6.12
2.6.13
2.6.14
2.6.15
2.6.16
RubyGems / puppet
Package
- Name
- puppet
- Purl
- pkg:gem/puppet