GCVE - cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*

part: a version: 1.2.3 update: *

Vendor	Puppet (`056a1ba3-12b3-5ecf-a97f-ab3b403c7816`)
Product	Puppet Enterprise (`f0f1d1ad-3d9e-59c3-8dee-09d0423ff49c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/puppetlabs/puppet`	purl2cpe	2026-06-01 10:14:37.329918

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-1989`	vulnerable	2026-06-08 05:00:52.197454	Details available telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log). Published: 2012-06-27T18:00:00.000Z Updated: 2024-08-06T19:17:27.600Z Open on db.gcve.eu Reference links http://projects.puppetlabs.com/issues/13606 http://ubuntu.com/usn/usn-1419-1 http://puppetlabs.com/security/cve/cve-2012-1989/ http://secunia.com/advisories/48743 https://exchange.xforce.ibmcloud.com/vulnerabilities/74797	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1987`	vulnerable	2026-06-08 05:00:52.183387	Details available Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations. Published: 2012-05-29T20:00:00.000Z Updated: 2024-08-06T19:17:27.604Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/74794 http://puppetlabs.com/security/cve/cve-2012-1987/ http://projects.puppetlabs.com/issues/13552 http://ubuntu.com/usn/usn-1419-1 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1986`	vulnerable	2026-06-08 05:00:52.182084	Details available Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket. Published: 2012-05-29T20:00:00.000Z Updated: 2024-08-06T19:17:27.701Z Open on db.gcve.eu Reference links http://ubuntu.com/usn/usn-1419-1 http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html http://puppetlabs.com/security/cve/cve-2012-1986/ https://hermes.opensuse.org/messages/14523305 https://exchange.xforce.ibmcloud.com/vulnerabilities/74794	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1906`	vulnerable	2026-06-08 05:00:51.319638	Details available Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp. Published: 2012-05-29T20:00:00.000Z Updated: 2024-08-06T19:17:27.063Z Open on db.gcve.eu Reference links http://projects.puppetlabs.com/issues/13260 http://ubuntu.com/usn/usn-1419-1 http://secunia.com/advisories/48743 https://exchange.xforce.ibmcloud.com/vulnerabilities/74793 http://puppetlabs.com/security/cve/cve-2012-1906/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1054`	vulnerable	2026-06-08 05:00:47.267449	Details available Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login. Published: 2012-05-29T20:00:00.000Z Updated: 2024-08-06T18:45:27.072Z Open on db.gcve.eu Reference links http://secunia.com/advisories/48157 http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 http://secunia.com/advisories/48166 http://projects.puppetlabs.com/issues/12460 http://www.osvdb.org/79496	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1053`	vulnerable	2026-06-08 05:00:47.262652	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-3872`	vulnerable	2026-06-08 04:59:28.230354	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.