CVE-2012-3866
Puppet allows local users to obtain sensitive configuration information
CVE-2012-3866 is a low vulnerability (CVSS 2.1) in Puppet, published July 12, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. Fixed in puppet 2.7.18.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.48%EPSS, 42nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.7.18puppet +3 more
Description
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetRubyGems | 2.7.0 up to 2.7.18 | 2.7.18 |
puppetDebian:11 | before 2.7.18-1 | 2.7.18-1 |
puppetDebian:6.0 From an advisory covering 4 CVEs | before 2.6.2-5+squeeze6, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze42.6.2-5+squeeze5 | 2.6.2-5+squeeze6 |
puppetRubyGems | 2.7.0 up to 2.7.18, plus listed versions 2.7.12.7.112.7.122.7.132.7.14 Show 8 moreShow less2.7.162.7.172.7.32.7.42.7.52.7.62.7.82.7.9 | 2.7.18 |
What each source reports
NVD Score used
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
- Record
CVE-2012-3866- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
- Record
CVE-2012-3866- Updated
- 2026-11-02
EUVDEUVD-2017-0193No score
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
- Record
EUVD-2017-0193- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jxj-9r5f-w3m2No score
Puppet allows local users to obtain sensitive configuration information
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
- Record
GHSA-8jxj-9r5f-w3m2- Updated
- 2026-11-02
OSVNo score
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
- Record
CVE-2012-3866- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3866No score
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
- Record
DEBIAN-CVE-2012-3866- Updated
- 2026-11-02
OSVGHSA-8jxj-9r5f-w3m2No score
Puppet allows local users to obtain sensitive configuration information
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
- Record
GHSA-8jxj-9r5f-w3m2- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10581-1No score
ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media
These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10581-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f
debian.org/security/2012/dsa-2511
ubuntu.com/usn/USN-1506-1
secunia.com/advisories/50014
lists.opensuse.org/opensuse-updates/2012-07/msg00036.html
puppetlabs.com/security/cve/cve-2012-3866
Show 18 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=839135
nvd.nist.gov/vuln/detail/CVE-2012-3866
puppet.com/security/cve/cve-2012-3866-lastrunreportyaml-world-readable
security-tracker.debian.org/tracker/CVE-2012-3866
suse.com/security/cve/CVE-2011-3848