CVE-2012-1054
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1...
CVE-2012-1054 is a medium vulnerability (CVSS 4.4) in Puppet, published February 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in puppet 2.7.11-1.
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
Exploit likelihood
What each source reports
NVD Score used
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
- Record
CVE-2012-1054- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
- Record
CVE-2012-1054- Updated
- 2026-11-02
EUVDEUVD-2012-1091 No score
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
- Record
EUVD-2012-1091- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9v7j-xc2x-vpx6 No score
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1...
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
- Record
GHSA-9v7j-xc2x-vpx6- Updated
- 2026-11-02
OSV No score
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
- Record
CVE-2012-1054- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-1054 No score
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
- Record
DEBIAN-CVE-2012-1054- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/48157
projects.puppetlabs.com/projects/1/wiki/Release_Notes
osvdb.org/79496
puppetlabs.com/security/cve/cve-2012-1054
Show 11 moreShow less
ubuntu.com/usn/usn-1372-1
lists.opensuse.org/opensuse-security-announce/2012-03/msg00003.html
securityfocus.com/bid/52158
debian.org/security/2012/dsa-2419
exchange.xforce.ibmcloud.com/vulnerabilities/73446
hermes.opensuse.org/messages/15087408
nvd.nist.gov/vuln/detail/CVE-2012-1054
github.com/advisories/GHSA-9v7j-xc2x-vpx6
security-tracker.debian.org/tracker/CVE-2012-1054