CVE-2012-1987

Description

Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use a marshaled form of a Puppet::FileBucket::File object to write to arbitrary file locations.

Risk Information

Base Score

6.5

MODERATE

Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.763

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2012-1987,CVE-2012-1988 are fixed in Ruby-puppet 2.6.15	Windows
Vulnerabilities CVE-2012-1987,CVE-2012-1988 are fixed in Ruby-puppet 2.7.13	Windows
Vulnerabilities CVE-2012-1987,CVE-2012-1988 are fixed in Ruby-puppet for Linux 2.6.15	Linux
Vulnerabilities CVE-2012-1987,CVE-2012-1988 are fixed in Ruby-puppet for Linux 2.7.13	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234