NetSight
IP …
medium4.3

CVE-2012-3867

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the cha…

Impact

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Affected products

VendorProductAffected versions
PuppetPuppet
Versions 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5
PuppetlabsPuppet
through 2.6.16
Versions 2.7.0, 2.7.1
DebianDebian Linux
Version 6.0
CanonicalUbuntu Linux
Versions 10.04, 11.04, 11.10, 12.04
OpensuseOpensuse
Versions 11.4, 12.1
SuseLinux Enterprise Desktop
Version 11
SuseLinux Enterprise Server
Version 11
PuppetPuppet Enterprise
through 2.5.1

Weakness classification

CWE-264

References