Every CVESearch/Get API key

CVE-2012-1906

Puppet uses predictable filenames, allowing arbitrary file overwrite

3.3 LowFix available

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Exploit likelihood

0.35%Down 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used3.3

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Record
CVE-2012-1906
CVSS 2.0
3.3 LowAV:L/AC:M/Au:N/C:N/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE ListNo score

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Record
CVE-2012-1906
Updated
2026-11-02
EUVDEUVD-2022-3504No score

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Record
EUVD-2022-3504
Updated
2026-11-03
GitHub AdvisoriesGHSA-c4mc-49hq-q275No score

Puppet uses predictable filenames, allowing arbitrary file overwrite

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Record
GHSA-c4mc-49hq-q275
Weakness
CWE-377
Updated
2026-11-02
OSVNo score

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Record
CVE-2012-1906
Updated
2026-11-02
OSVDEBIAN-CVE-2012-1906No score

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Record
DEBIAN-CVE-2012-1906
Updated
2026-11-02
OSVGHSA-c4mc-49hq-q275No score

Puppet uses predictable filenames, allowing arbitrary file overwrite

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.

Record
GHSA-c4mc-49hq-q275
Weakness
CWE-377
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
puppet
RubyGems
2.6 up to 2.6.15
2.6.15
puppet
RubyGems
2.7 up to 2.7.13
2.7.13
puppet
Debian:11
before 2.7.13-1
2.7.13-1
puppet
Debian:6.0
From an advisory covering 4 CVEs
before 2.6.2-5+squeeze5, plus listed versions
2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze4
2.6.2-5+squeeze5
puppet
RubyGems
2.6 up to 2.6.15, plus listed versions
2.6.02.6.12.6.102.6.112.6.12
Show 10 moreShow less
2.6.132.6.142.6.22.6.32.6.42.6.52.6.62.6.72.6.82.6.9
2.6.15
puppet
RubyGems
2.7 up to 2.7.13, plus listed versions
2.7.12.7.112.7.122.7.32.7.4
Show 4 moreShow less
2.7.52.7.62.7.82.7.9
2.7.13

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-1906 is a low vulnerability (CVSS 3.3) in Puppet, published April 13, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. Fixed in puppet 2.6.15.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open