Home > Vulnerability Database > CVE-2012-1987

Mend.io Vulnerability Database

CVE-2012-1987

Date: May 29, 2012

Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.

Language: Ruby

Severity Score

3.1

Related Resources (31)

Url: http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15

Url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1987.yml

Url: https://hermes.opensuse.org/messages/15087408

Url: http://projects.puppetlabs.com/issues/13553

Url: https://github.com/advisories/GHSA-v58w-6xc2-w799

Url: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html

Url: https://web.archive.org/web/20120513213318/http://projects.puppetlabs.com/issues/13553

Url: http://projects.puppetlabs.com/issues/13552

Url: https://nvd.nist.gov/vuln/detail/CVE-2012-1987

Url: http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html

Url: http://puppetlabs.com/security/cve/cve-2012-1987/

Url: https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975

Url: http://www.securityfocus.com/bid/52975

Url: http://www.debian.org/security/2012/dsa-2451

Url: https://github.com/puppetlabs/puppet/commit/568ded50ec6cc498ad32ff7f086d9f73b5d24c14

Url: https://web.archive.org/web/20120513224202/http://projects.puppetlabs.com/issues/13552

Url: http://www.osvdb.org/81308

Url: https://web.archive.org/web/20160808163232/https://puppet.com/security/cve/cve-2012-1987

Url: https://github.com/puppetlabs/puppet/commit/0d6d29933e613fe177e9235415919a5428db67bc

Url: http://secunia.com/advisories/48789

Url: https://github.com/puppetlabs/puppet

Url: https://web.archive.org/web/20121005145241/http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15

Url: http://secunia.com/advisories/48748

Url: https://exchange.xforce.ibmcloud.com/vulnerabilities/74794

Url: https://hermes.opensuse.org/messages/14523305

Url: http://ubuntu.com/usn/usn-1419-1

Url: http://secunia.com/advisories/49136

Url: http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html

Url: http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/

Url: http://secunia.com/advisories/48743

Url: https://www.mend.io/vulnerability-database/CVE-2012-1987

Severity Score

3.1

Weakness Type (CWE)

Uncontrolled Resource Consumption ('Resource Exhaustion')

CWE-400

Insufficient Information

NVD-CWE-noinfo

CVSS v3.1

Base Score:	3.1
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	LOW

CVSS v2

Base Score:	3.5
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	SINGLE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2012-1987

Date: May 29, 2012

Language: Ruby

Severity Score

Related Resources (31)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?