VYPR
← All advisories
Low severityNVD Advisory· Published Aug 6, 2012· Updated Jun 16, 2026

CVE-2012-3866

CVE-2012-3866

Description

lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
puppetRubyGems
>= 2.7.0, < 2.7.182.7.18

Affected products

18
  • Puppet (software)/Puppet16 versions
    cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*+ 15 more
    • cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*range: <=2.7.17
    • cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
    • cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*
  • Puppet (software)/Puppet Enterprise
    cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
    Range: <=2.5.1
  • ghsa-coords
    pkg:gem/puppet
    Range: >= 2.7.0, < 2.7.18

Patches

Vulnerability mechanics

References

12

News mentions

0

No linked articles in our index yet.