CVE-2012-1989
Puppet allows local users to overwrite arbitrary files via a symlink attack
CVE-2012-1989 is a low vulnerability (CVSS 3.6) in Puppet, published June 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in puppet 2.7.13.
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
Exploit likelihood
What each source reports
NVD Score used
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- Record
CVE-2012-1989- CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- Record
CVE-2012-1989- Updated
- 2026-11-02
EUVDEUVD-2017-0212 No score
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- Record
EUVD-2017-0212- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5qq-g673-5p49 No score
Puppet allows local users to overwrite arbitrary files via a symlink attack
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- Record
GHSA-c5qq-g673-5p49- Updated
- 2026-11-02
OSV No score
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- Record
CVE-2012-1989- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-1989 No score
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- Record
DEBIAN-CVE-2012-1989- Updated
- 2026-11-02
OSVGHSA-c5qq-g673-5p49 No score
Puppet allows local users to overwrite arbitrary files via a symlink attack
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- Record
GHSA-c5qq-g673-5p49- Updated
- 2026-11-02
Affected products
Affected packages
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
projects.puppetlabs.com/issues/13606
ubuntu.com/usn/usn-1419-1
puppetlabs.com/security/cve/cve-2012-1989
secunia.com/advisories/48743
exchange.xforce.ibmcloud.com/vulnerabilities/74797
Show 12 moreShow less
securityfocus.com/bid/52975
lists.opensuse.org/opensuse-updates/2012-05/msg00012.html
hermes.opensuse.org/messages/15087408
nvd.nist.gov/vuln/detail/CVE-2012-1989
github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1989.yml
web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975
puppet.com/security/cve/cve-2012-1989-arbitrary-file-write-access
security-tracker.debian.org/tracker/CVE-2012-1989