CVE-2012-1906
Puppet uses predictable filenames, allowing arbitrary file overwrite
CVE-2012-1906 is a low vulnerability (CVSS 3.3) in Puppet, published April 13, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in puppet 2.6.15.
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
Exploit likelihood
What each source reports
NVD Score used
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
- Record
CVE-2012-1906- CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
- Record
CVE-2012-1906- Updated
- 2026-11-02
EUVDEUVD-2022-3504 No score
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
- Record
EUVD-2022-3504- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c4mc-49hq-q275 No score
Puppet uses predictable filenames, allowing arbitrary file overwrite
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
- Record
GHSA-c4mc-49hq-q275- Weakness
- CWE-377
- Updated
- 2026-11-02
OSV No score
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
- Record
CVE-2012-1906- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-1906 No score
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
- Record
DEBIAN-CVE-2012-1906- Updated
- 2026-11-02
OSVGHSA-c4mc-49hq-q275 No score
Puppet uses predictable filenames, allowing arbitrary file overwrite
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
- Record
GHSA-c4mc-49hq-q275- Weakness
- CWE-377
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetRubyGems |
2.6 up to 2.6.15 | 2.6.15 |
puppetRubyGems |
2.7 up to 2.7.13 | 2.7.13 |
puppetDebian:11 |
before 2.7.13-1 | 2.7.13-1 |
puppetDebian:6.0 |
before 2.6.2-5+squeeze5, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze4 |
2.6.2-5+squeeze5 |
puppetRubyGems |
2.6 up to 2.6.15, plus listed versions 2.6.02.6.12.6.102.6.112.6.12 Show 10 moreShow less2.6.132.6.142.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9 |
2.6.15 |
puppetRubyGems |
2.7 up to 2.7.13, plus listed versions 2.7.12.7.112.7.122.7.32.7.4 Show 4 moreShow less2.7.52.7.62.7.82.7.9 |
2.7.13 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
projects.puppetlabs.com/issues/13260
ubuntu.com/usn/usn-1419-1
secunia.com/advisories/48743
exchange.xforce.ibmcloud.com/vulnerabilities/74793
puppetlabs.com/security/cve/cve-2012-1906
securityfocus.com/bid/52975
Show 9 moreShow less
debian.org/security/2012/dsa-2451
nvd.nist.gov/vuln/detail/CVE-2012-1906
github.com/puppetlabs/puppet/commit/f7829ec1f1b2c3def8e0eda09c22c3c1fed3a27f
web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975
security-tracker.debian.org/tracker/CVE-2012-1906