cbcvebase.
CVE-2012-3867
published 2012-08-06

CVE-2012-3867: lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the…

medium4.3CVSS 3.1
AVNACMAuNCNIPAN
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Affected

48 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debianpuppet< puppet 2.7.18-1 (bullseye)puppet 2.7.18-1 (bullseye)
opensuseopensuse
opensuseopensuse
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet

CVSS provenance

nvd4.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv4.3MEDIUM