LOW

GHSA-vxf6-w9mp-95hm

Puppet supports use of IP addresses in certnames without warning of potential risks

Quick fix

GHSA-vxf6-w9mp-95hm — puppet: upgrade to the fixed version with the command below.

bundle update puppet

Details

`lib/puppet/network/authstore.rb` in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/puppet

Introduced in: 0Fixed in: 2.7.18

Fixbundle update puppet

References

https://nvd.nist.gov/vuln/detail/CVE-2012-3408[ADVISORY]
https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd[WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=839166[WEB]
https://github.com/puppetlabs/puppet[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3408.yml[WEB]
https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation[WEB]
http://puppetlabs.com/security/cve/cve-2012-3408[WEB]