CVE-2012-3408.yml

---
gem: puppet
cve: 2012-3408
ghsa: vxf6-w9mp-95hm
url: https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation
title: Agent Imprersonation in Puppet
date: 2017-10-24
description: |
  lib/puppet/network/authstore.rb in Puppet before 2.7.18, and
  Puppet Enterprise before 2.5.2, supports use of IP addresses in
  certnames without warning of potential risks, which might allow
  remote attackers to spoof an agent by acquiring a previously
  used IP address.
cvss_v2: 2.6
patched_versions:
  - ">= 2.7.18"
related:
  url:
    - https://nvd.nist.gov/vuln/detail/CVE-2012-3408
    - https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation
    - https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd
    - https://github.com/advisories/GHSA-vxf6-w9mp-95hm
    - https://bugzilla.redhat.com/show_bug.cgi?id=839166