Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 2.7.13-1 | — |
| Debian 6.0 | puppet | 2.6.2-5+squeeze5 | DSA-2451-1 |
Advisories 1
- DSA-2451-1 puppet - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- USN-1419-1 vendor-advisory
- FEDORA-2012-5999 vendor-advisory
- http://puppetlabs.com/security/cve/cve-2012-1986/
- openSUSE-SU-2012:0608 vendor-advisory
- puppet-rest-symlink(74794) vdb-entry
- 48743 third-party-advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
- FEDORA-2012-6055 vendor-advisory
- FEDORA-2012-6674 vendor-advisory
- http://projects.puppetlabs.com/issues/13511
- 49136 third-party-advisory
- 52975 vdb-entry
- 48748 third-party-advisory
- DSA-2451 vendor-advisory
- openSUSE-SU-2012:0835 vendor-advisory
- 48789 third-party-advisory