Description
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 2.7.13-1 | — |
| Debian 6.0 | puppet | 2.6.2-5+squeeze5 | DSA-2451-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | >= 2.6.0, < 2.6.15 | 2.6.15 | GHSA-6xxq-j39w-g3f6 |
| RubyGems | puppet | >= 2.7.0, < 2.7.13 | 2.7.13 | GHSA-6xxq-j39w-g3f6 |
Advisories 1
- DSA-2451-1 puppet - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 81309 vdb-entry
- USN-1419-1 vendor-advisory
- FEDORA-2012-5999 vendor-advisory
- http://puppetlabs.com/security/cve/cve-2012-1988/
- http://projects.puppetlabs.com/issues/13518
- openSUSE-SU-2012:0608 vendor-advisory
- 48743 third-party-advisory
- http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15
- puppet-file-bucket-command-exec(74796) vdb-entry
- FEDORA-2012-6055 vendor-advisory
- FEDORA-2012-6674 vendor-advisory
- 49136 third-party-advisory
- 52975 vdb-entry
- 48748 third-party-advisory
- DSA-2451 vendor-advisory
- openSUSE-SU-2012:0835 vendor-advisory
- 48789 third-party-advisory