Every CVE Search/ Get API key

CVE-2012-3867

Pupper does not properly restrict characters in Common Name field of Certificate Signing Request

4.3 MediumFix available

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Exploit likelihood

2.45%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Record
CVE-2012-3867
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Record
CVE-2012-3867
Updated
2026-11-02
EUVDEUVD-2017-0285 No score

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Record
EUVD-2017-0285
Updated
2026-11-03
GitHub AdvisoriesGHSA-q44r-f2hm-v76v No score

Pupper does not properly restrict characters in Common Name field of Certificate Signing Request

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Record
GHSA-q44r-f2hm-v76v
Updated
2026-11-02
OSV No score

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Record
CVE-2012-3867
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3867 No score

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Record
DEBIAN-CVE-2012-3867
Updated
2026-11-02
OSVGHSA-q44r-f2hm-v76v No score

Pupper does not properly restrict characters in Common Name field of Certificate Signing Request

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

Record
GHSA-q44r-f2hm-v76v
Updated
2026-11-02
OSVopenSUSE-SU-2024:10581-1 No score

ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media

These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10581-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
puppet
RubyGems
 before 2.6.17
2.6.17
puppet
RubyGems
 2.7.0 up to 2.7.18
2.7.18
puppet
Debian:11
 before 2.7.18-1
2.7.18-1
puppet
Debian:6.0
 before 2.6.2-5+squeeze6, plus listed versions
2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze42.6.2-5+squeeze5
2.6.2-5+squeeze6
puppet
RubyGems
 before 2.6.17, plus listed versions
0.13.00.13.10.13.20.13.60.16.0
Show 39 moreShow less
0.18.40.22.40.23.00.23.10.23.20.24.00.24.10.24.20.24.30.24.40.24.50.24.60.24.70.24.80.24.90.25.00.25.10.25.20.25.30.25.40.25.50.9.22.6.02.6.12.6.102.6.112.6.122.6.132.6.142.6.152.6.162.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9
2.6.17
puppet
RubyGems
 2.7.0 up to 2.7.18, plus listed versions
2.7.12.7.112.7.122.7.132.7.14
Show 8 moreShow less
2.7.162.7.172.7.32.7.42.7.52.7.62.7.82.7.9
2.7.18

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-3867 is a medium vulnerability (CVSS 4.3) in Puppet, published July 12, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.45%, the 84th percentile. Fixed in puppet 2.6.17.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open