Description
Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 2.7.13-1 | — |
| Debian 6.0 | puppet | 2.6.2-5+squeeze5 | DSA-2451-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | >= 2.6.0, < 2.6.15 | 2.6.15 | GHSA-v58w-6xc2-w799 |
| RubyGems | puppet | >= 2.7.0, < 2.7.13 | 2.7.13 | GHSA-v58w-6xc2-w799 |
Advisories 1
- DSA-2451-1 puppet - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- puppet-rest-dos(74795) vdb-entry
- http://puppetlabs.com/security/cve/cve-2012-1987/
- http://projects.puppetlabs.com/issues/13552
- USN-1419-1 vendor-advisory
- FEDORA-2012-5999 vendor-advisory
- openSUSE-SU-2012:0608 vendor-advisory
- 48743 third-party-advisory
- http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
- FEDORA-2012-6055 vendor-advisory
- FEDORA-2012-6674 vendor-advisory
- 49136 third-party-advisory
- 81308 vdb-entry
- 52975 vdb-entry
- 48748 third-party-advisory
- DSA-2451 vendor-advisory
- http://projects.puppetlabs.com/issues/13553
- openSUSE-SU-2012:0835 vendor-advisory
- 48789 third-party-advisory