CVE-2012-3408
Puppet supports use of IP addresses in certnames without warning of potential risks
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Exploit likelihood
What each source reports
NVD Score used
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
- Record
CVE-2012-3408- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
- Record
CVE-2012-3408- Updated
- 2026-11-02
EUVDEUVD-2017-0315 No score
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
- Record
EUVD-2017-0315- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vxf6-w9mp-95hm No score
Puppet supports use of IP addresses in certnames without warning of potential risks
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
- Record
GHSA-vxf6-w9mp-95hm- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
- Record
CVE-2012-3408- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3408 No score
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
- Record
DEBIAN-CVE-2012-3408- Updated
- 2026-11-02
OSVGHSA-vxf6-w9mp-95hm No score
Puppet supports use of IP addresses in certnames without warning of potential risks
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
- Record
GHSA-vxf6-w9mp-95hm- Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetRubyGems |
before 2.7.18 | 2.7.18 |
puppetDebian:11 |
before 2.7.18-1 | 2.7.18-1 |
puppetRubyGems |
before 2.7.18, plus listed versions 0.13.00.13.10.13.20.13.60.16.0 Show 45 moreShow less0.18.40.22.40.23.00.23.10.23.20.24.00.24.10.24.20.24.30.24.40.24.50.24.60.24.70.24.80.24.90.25.00.25.10.25.20.25.30.25.40.25.50.9.22.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.172.6.182.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.92.7.12.7.112.7.122.7.13 |
2.7.18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3408 is a low vulnerability (CVSS 2.6) in Puppet Enterprise, published August 6, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in puppet 2.7.18.
References
bugzilla.redhat.com/show_bug.cgi?id=839166
puppetlabs.com/security/cve/cve-2012-3408
github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd
nvd.nist.gov/vuln/detail/CVE-2012-3408
puppet.com/security/cve/cve-2012-3408-agent-impersonation
security-tracker.debian.org/tracker/CVE-2012-3408
Left out here: 9 versions. The JSON record has them.