CVE-2012-1987

Description

Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.

3.5

CVSS

Severity: Low

CVSS 2.0 •

EPSS 0.66% Top 30%

Vendor Advisory ubuntu.com Vendor Advisory fedoraproject.org Vendor Advisory opensuse.org Vendor Advisory fedoraproject.org Vendor Advisory fedoraproject.org Vendor Advisory debian.org Vendor Advisory opensuse.org Vendor Advisory puppetlabs.com Vendor Advisory puppetlabs.com Vendor Advisory puppetlabs.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
https://exchange.xforce.ibmcloud.com/vulnerabilities/74794	vdb entry
http://puppetlabs.com/security/cve/cve-2012-1987/	vendor advisory
http://projects.puppetlabs.com/issues/13552	vendor advisory
http://ubuntu.com/usn/usn-1419-1	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html	vendor advisory
https://hermes.opensuse.org/messages/14523305	vendor advisory
http://secunia.com/advisories/48743	third party advisory vendor advisory
http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/
http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html	vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html	vendor advisory
http://secunia.com/advisories/49136	third party advisory vendor advisory
http://www.osvdb.org/81308	vdb entry
http://www.securityfocus.com/bid/52975	vdb entry
http://secunia.com/advisories/48748	third party advisory vendor advisory
http://www.debian.org/security/2012/dsa-2451	vendor advisory
http://projects.puppetlabs.com/issues/13553	vendor advisory
https://hermes.opensuse.org/messages/15087408	vendor advisory
http://secunia.com/advisories/48789	third party advisory vendor advisory

Frequently Asked Questions

What is the severity of CVE-2012-1987?: CVE-2012-1987 has been scored as a low severity vulnerability.
How to fix CVE-2012-1987?: To fix CVE-2012-1987, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2012-1987 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2012-1987 is being actively exploited. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.