Action not permitted
Modal body text goes here.
cve-2012-3867
Vulnerability from cvelistv5
Published
2012-08-06 16:00
Modified
2024-08-06 20:21
Severity ?
EPSS score ?
Summary
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
References
▼ | URL | Tags | |
---|---|---|---|
cve@mitre.org | http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html | Third Party Advisory | |
cve@mitre.org | http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html | Third Party Advisory | |
cve@mitre.org | http://puppetlabs.com/security/cve/cve-2012-3867/ | Vendor Advisory | |
cve@mitre.org | http://secunia.com/advisories/50014 | ||
cve@mitre.org | http://www.debian.org/security/2012/dsa-2511 | Third Party Advisory | |
cve@mitre.org | http://www.ubuntu.com/usn/USN-1506-1 | Third Party Advisory | |
cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=839158 | Issue Tracking | |
cve@mitre.org | https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640 | Exploit, Patch, Issue Tracking | |
cve@mitre.org | https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50 | Exploit, Patch, Issue Tracking |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T20:21:04.014Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "SUSE-SU-2012:0983", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html" }, { "name": "DSA-2511", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "http://www.debian.org/security/2012/dsa-2511" }, { "name": "USN-1506-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-1506-1" }, { "name": "50014", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/50014" }, { "name": "openSUSE-SU-2012:0891", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://puppetlabs.com/security/cve/cve-2012-3867/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2012-07-11T00:00:00", "descriptions": [ { "lang": "en", "value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2014-10-08T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "SUSE-SU-2012:0983", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html" }, { "name": "DSA-2511", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "http://www.debian.org/security/2012/dsa-2511" }, { "name": "USN-1506-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-1506-1" }, { "name": "50014", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/50014" }, { "name": "openSUSE-SU-2012:0891", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://puppetlabs.com/security/cve/cve-2012-3867/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-3867", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "SUSE-SU-2012:0983", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html" }, { "name": "DSA-2511", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2511" }, { "name": "USN-1506-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1506-1" }, { "name": "50014", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/50014" }, { "name": "openSUSE-SU-2012:0891", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html" }, { "name": "http://puppetlabs.com/security/cve/cve-2012-3867/", "refsource": "CONFIRM", "url": "http://puppetlabs.com/security/cve/cve-2012-3867/" }, { "name": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640", "refsource": "CONFIRM", "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640" }, { "name": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50", "refsource": "CONFIRM", "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=839158", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-3867", "datePublished": "2012-08-06T16:00:00", "dateReserved": "2012-07-06T00:00:00", "dateUpdated": "2024-08-06T20:21:04.014Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2012-3867\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2012-08-06T16:55:06.680\",\"lastModified\":\"2019-07-10T18:02:28.767\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.\"},{\"lang\":\"es\",\"value\":\"lib/puppet/ssl/certificate_authority.rb en Puppet anteriores a v2.6.17 y v2.7.x anteriores a v2.7.18, y Puppet Enterprise anterior a v2.5.2, no restringe de forma adecuada los caracteres en el campo Common Name de una Certificate Signing Request (CSR), lo que facilita a atacantes remotos asistidos por usuarios a enga\u00f1ar a los administradores para firmar un certificado manipulado a trav\u00e9s de secuencias de control ANSI.\\r\\n\\r\\n\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9BEF50EE-4E4B-4641-BA34-B5024F1EF683\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CC72248-FD33-4CA0-A16E-0A174A864257\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CEFB16E-261F-4B81-BCBE-536CAD2EC44B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"652D28FC-7133-4C5F-95D9-3468548465B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AEEEE59D-BC0E-4107-B55D-9B182825E557\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4ED400E-48F7-475B-A87C-A14EC63DD93D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D827D4C2-7438-4EDD-9025-38D46CD5153C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E73C341A-6C07-4820-B1D3-4616B634F380\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61381D4C-972F-4979-84D2-793E4C60E23E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7D8C2A71-0277-4426-8627-D6FD275EFC62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3FB3C44C-2C6C-496C-9D2E-C43FFB493C42\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD2656B0-9606-477B-BEB3-35746218BF9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"848F82FB-ACCE-42C0-A208-55522A030835\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0BBFAA7-BB3F-49D2-975B-01194C66D7C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"515BBBBF-7F42-490E-BF9D-B01AA3DD61C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"508105B4-619A-4A9D-8B2F-FE5992C1006A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26DB96A5-A57D-452F-A452-98B11F51CAE6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D33AF704-FA05-4EA8-BE95-0177871A810F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"390FC5AE-4939-468C-B323-6B4E267A0F4C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07DE4213-E233-402E-88C2-B7FF8D7B682C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4122D8E3-24AD-4A55-9F89-C3AAD50E638D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF6D6B90-62BA-4944-A699-6D7C48AFD0A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8EC6A7B3-5949-4439-994A-68DA65438F5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5140C34D-589C-43DB-BCA7-8434EB173205\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E561C081-6262-46D3-AB17-01EEA6D3E988\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4703802D-0E3A-4760-B660-6AE0AF74DD40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE3D39F6-F9C8-4E7F-981A-265B04E85579\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FEBB3936-7A81-4BD9-80B2-3F614980BBCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.6.16\",\"matchCriteriaId\":\"BE6F41EF-556F-42E0-B26C-B96CD9C77B2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E5192CB-094F-469E-A644-2255C4F44804\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"036E8A89-7A16-411F-9D31-676313BB7244\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"5D37DF0F-F863-45AC-853A-3E04F9FEC7CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF49D26F-142E-468B-87C1-BABEA445255C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4174F4F-149E-41A6-BBCC-D01114C05F38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"B6B7CAD7-9D4E-4FDB-88E3-1E583210A01F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE554781-1EB9-446E-911F-6C11970C47F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EBB2C482-D2A4-48B3-ACE7-E1DFDCC409B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"60FBDD82-691C-4D9D-B71B-F9AFF6931B53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"00720D8C-3FF3-4B1C-B74B-91F01A544399\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE26596F-F10E-44EF-88CA-0080646E91B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*\",\"matchCriteriaId\":\"A6B7CDCA-6F39-4113-B5D3-3AA9D7F3D809\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"F084E6C1-8DB0-4D1F-B8EB-5D2CD9AD6E87\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"2.5.1\",\"matchCriteriaId\":\"F66C1E54-FBEA-4008-BC88-A390D415F3F5\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://puppetlabs.com/security/cve/cve-2012-3867/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/50014\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.debian.org/security/2012/dsa-2511\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-1506-1\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=839158\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\",\"Issue Tracking\"]},{\"url\":\"https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\",\"Issue Tracking\"]}]}}" } }
gsd-2012-3867
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2012-3867", "description": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.", "id": "GSD-2012-3867", "references": [ "https://www.suse.com/security/cve/CVE-2012-3867.html", "https://www.debian.org/security/2012/dsa-2511", "https://access.redhat.com/errata/RHSA-2012:1542", "https://alas.aws.amazon.com/cve/html/CVE-2012-3867.html" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2012-3867" ], "details": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.", "id": "GSD-2012-3867", "modified": "2023-12-13T01:20:21.144607Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-3867", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "SUSE-SU-2012:0983", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html" }, { "name": "DSA-2511", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2511" }, { "name": "USN-1506-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1506-1" }, { "name": "50014", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/50014" }, { "name": "openSUSE-SU-2012:0891", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html" }, { "name": "http://puppetlabs.com/security/cve/cve-2012-3867/", "refsource": "CONFIRM", "url": "http://puppetlabs.com/security/cve/cve-2012-3867/" }, { "name": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640", "refsource": "CONFIRM", "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640" }, { "name": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50", "refsource": "CONFIRM", "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=839158", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "\u003c2.6.17||\u003e=2.7.0 \u003c2.7.18", "affected_versions": "All versions before 2.6.17, all versions starting from 2.7.0 before 2.7.18", "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "cwe_ids": [ "CWE-1035", "CWE-264", "CWE-937" ], "date": "2021-09-16", "description": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.", "fixed_versions": [ "2.6.17", "2.7.18" ], "identifier": "CVE-2012-3867", "identifiers": [ "GHSA-q44r-f2hm-v76v", "CVE-2012-3867" ], "not_impacted": "All versions starting from 2.6.17 before 2.7.0, all versions starting from 2.7.18", "package_slug": "gem/puppet", "pubdate": "2017-10-24", "solution": "Upgrade to versions 2.6.17, 2.7.18 or above.", "title": "Moderate severity vulnerability that affects puppet", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2012-3867", "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640", "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50", "https://bugzilla.redhat.com/show_bug.cgi?id=839158", "https://github.com/advisories/GHSA-q44r-f2hm-v76v", "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html", "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html", "http://puppetlabs.com/security/cve/cve-2012-3867/", "http://secunia.com/advisories/50014", "http://www.debian.org/security/2012/dsa-2511", "http://www.ubuntu.com/usn/USN-1506-1" ], "uuid": "0ff26ee1-2962-454b-96cc-0da618aa1b49" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2.6.16", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:vmware:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "2.5.1", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2012-3867" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-264" } ] } ] }, "references": { "reference_data": [ { "name": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640", "refsource": "CONFIRM", "tags": [ "Exploit", "Patch", "Issue Tracking" ], "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=839158", "refsource": "CONFIRM", "tags": [ "Issue Tracking" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" }, { "name": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50", "refsource": "CONFIRM", "tags": [ "Exploit", "Patch", "Issue Tracking" ], "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50" }, { "name": "http://puppetlabs.com/security/cve/cve-2012-3867/", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "http://puppetlabs.com/security/cve/cve-2012-3867/" }, { "name": "SUSE-SU-2012:0983", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html" }, { "name": "DSA-2511", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "http://www.debian.org/security/2012/dsa-2511" }, { "name": "USN-1506-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "http://www.ubuntu.com/usn/USN-1506-1" }, { "name": "50014", "refsource": "SECUNIA", "tags": [], "url": "http://secunia.com/advisories/50014" }, { "name": "openSUSE-SU-2012:0891", "refsource": "SUSE", "tags": [ "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true } }, "lastModifiedDate": "2019-07-10T18:02Z", "publishedDate": "2012-08-06T16:55Z" } } }
ghsa-q44r-f2hm-v76v
Vulnerability from github
Published
2017-10-24 18:33
Modified
2023-05-12 17:21
Summary
Pupper does not properly restrict characters in Common Name field of Certificate Signing Request
Details
lib/puppet/ssl/certificate_authority.rb
in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
{ "affected": [ { "package": { "ecosystem": "RubyGems", "name": "puppet" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "2.6.17" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "RubyGems", "name": "puppet" }, "ranges": [ { "events": [ { "introduced": "2.7.0" }, { "fixed": "2.7.18" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2012-3867" ], "database_specific": { "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:50:50Z", "nvd_published_at": null, "severity": "MODERATE" }, "details": "`lib/puppet/ssl/certificate_authority.rb` in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.", "id": "GHSA-q44r-f2hm-v76v", "modified": "2023-05-12T17:21:34Z", "published": "2017-10-24T18:33:37Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3867" }, { "type": "WEB", "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640" }, { "type": "WEB", "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" }, { "type": "PACKAGE", "url": "https://github.com/puppetlabs/puppet" }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3867.yml" }, { "type": "WEB", "url": "https://www.puppet.com/security/cve/cve-2012-3867-insufficient-input-validation" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html" }, { "type": "WEB", "url": "http://puppetlabs.com/security/cve/cve-2012-3867" }, { "type": "WEB", "url": "http://www.debian.org/security/2012/dsa-2511" }, { "type": "WEB", "url": "http://www.ubuntu.com/usn/USN-1506-1" } ], "schema_version": "1.4.0", "severity": [], "summary": "Pupper does not properly restrict characters in Common Name field of Certificate Signing Request" }
rhsa-2012_1542
Vulnerability from csaf_redhat
Published
2012-12-04 19:24
Modified
2024-11-05 17:54
Summary
Red Hat Security Advisory: CloudForms Commons 1.1 security update
Notes
Topic
Updated CloudForms Commons packages that fix several security issues are
now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat CloudForms is an on-premise hybrid cloud
Infrastructure-as-a-Service (IaaS) product that lets you create and manage
private and public clouds.
Multiple input validation vulnerabilities were discovered in
rubygem-activerecored. A remote attacker could possibly use these flaws
to perform an SQL injection attack against an application using
rubygem-activerecord. (CVE-2012-2660, CVE-2012-2661, CVE-2012-2694,
CVE-2012-2695)
Multiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.
A remote attacker could use these flaws to conduct XSS attacks against
users of an application using rubygem-actionpack. (CVE-2012-3463,
CVE-2012-3464, CVE-2012-3465)
A flaw was found in the HTTP digest authentication implementation in
rubygem-actionpack. A remote attacker could use this flaw to cause a
denial of service of an application using rubygem-actionpack and digest
authentication. (CVE-2012-3424)
An input validation flaw was found in rubygem-mail's Exim and Sendmail
delivery methods. A remote attacker could use this flaw to execute
arbitrary commands with the privileges of an application using
rubygem-mail. (CVE-2012-2140)
A directory traversal flaw was found in rubygem-mail's file delivery
method. A remote attacker could use this flaw to send a mail with a
specially crafted To: header and write to files with the privileges of
an application using rubygem-mail. (CVE-2012-2139)
Puppet was updated to version 2.6.17, which fixes multiple security
issues. These issues are not exposed by CloudForms. (CVE-2012-1986,
CVE-2012-1987, CVE-2012-1988, CVE-2012-3864, CVE-2012-3865, CVE-2012-3867)
Red Hat would like to thank Puppet Labs for reporting CVE-2012-1988,
CVE-2012-1986, CVE-2012-1987, CVE-2012-3864, CVE-2012-3865, and
CVE-2012-3867.
Users are advised to upgrade to these CloudForms Commons packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated CloudForms Commons packages that fix several security issues are\nnow available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat CloudForms is an on-premise hybrid cloud\nInfrastructure-as-a-Service (IaaS) product that lets you create and manage\nprivate and public clouds.\n\nMultiple input validation vulnerabilities were discovered in\nrubygem-activerecored. A remote attacker could possibly use these flaws\nto perform an SQL injection attack against an application using\nrubygem-activerecord. (CVE-2012-2660, CVE-2012-2661, CVE-2012-2694,\nCVE-2012-2695)\n\nMultiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.\nA remote attacker could use these flaws to conduct XSS attacks against\nusers of an application using rubygem-actionpack. (CVE-2012-3463,\nCVE-2012-3464, CVE-2012-3465)\n\nA flaw was found in the HTTP digest authentication implementation in\nrubygem-actionpack. A remote attacker could use this flaw to cause a\ndenial of service of an application using rubygem-actionpack and digest\nauthentication. (CVE-2012-3424)\n\nAn input validation flaw was found in rubygem-mail\u0027s Exim and Sendmail\ndelivery methods. A remote attacker could use this flaw to execute\narbitrary commands with the privileges of an application using\nrubygem-mail. (CVE-2012-2140)\n\nA directory traversal flaw was found in rubygem-mail\u0027s file delivery\nmethod. A remote attacker could use this flaw to send a mail with a\nspecially crafted To: header and write to files with the privileges of\nan application using rubygem-mail. (CVE-2012-2139)\n\nPuppet was updated to version 2.6.17, which fixes multiple security\nissues. These issues are not exposed by CloudForms. (CVE-2012-1986,\nCVE-2012-1987, CVE-2012-1988, CVE-2012-3864, CVE-2012-3865, CVE-2012-3867)\n\nRed Hat would like to thank Puppet Labs for reporting CVE-2012-1988,\nCVE-2012-1986, CVE-2012-1987, CVE-2012-3864, CVE-2012-3865, and\nCVE-2012-3867.\n\nUsers are advised to upgrade to these CloudForms Commons packages, which\nresolve these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2012:1542", "url": "https://access.redhat.com/errata/RHSA-2012:1542" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "810069", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810069" }, { "category": "external", "summary": "810070", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810070" }, { "category": "external", "summary": "810071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810071" }, { "category": "external", "summary": "816352", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352" }, { "category": "external", "summary": "827353", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353" }, { "category": "external", "summary": "827363", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363" }, { "category": "external", "summary": "831573", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573" }, { "category": "external", "summary": "831581", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581" }, { "category": "external", "summary": "839130", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130" }, { "category": "external", "summary": "839131", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131" }, { "category": "external", "summary": "839158", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" }, { "category": "external", "summary": "843711", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711" }, { "category": "external", "summary": "847196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196" }, { "category": "external", "summary": "847199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199" }, { "category": "external", "summary": "847200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1542.json" } ], "title": "Red Hat Security Advisory: CloudForms Commons 1.1 security update", "tracking": { "current_release_date": "2024-11-05T17:54:07+00:00", "generator": { "date": "2024-11-05T17:54:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2012:1542", "initial_release_date": "2012-12-04T19:24:00+00:00", "revision_history": [ { "date": "2012-12-04T19:24:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2012-12-04T19:29:06+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T17:54:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudForms Cloud Engine for RHEL 6 Server", "product": { "name": "CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine", "product_identification_helper": { "cpe": "cpe:/a:cloudforms_cloudengine:1::el6" } } }, { "category": "product_name", "name": "CloudForms System Engine for RHEL 6 Server", "product": { "name": "CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine", "product_identification_helper": { "cpe": "cpe:/a:cloudforms_systemengine:1::el6" } } } ], "category": "product_family", "name": "Red Hat CloudForms" }, { "branches": [ { "category": "product_version", "name": "puppet-server-0:2.6.17-2.el6cf.noarch", "product": { "name": "puppet-server-0:2.6.17-2.el6cf.noarch", "product_id": "puppet-server-0:2.6.17-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/puppet-server@2.6.17-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "puppet-0:2.6.17-2.el6cf.noarch", "product": { "name": "puppet-0:2.6.17-2.el6cf.noarch", "product_id": "puppet-0:2.6.17-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/puppet@2.6.17-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "product": { "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "product_id": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-4.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "product": { "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "product_id": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-10.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch", "product": { "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch", "product_id": "rubygem-mail-0:2.3.0-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-mail@2.3.0-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "product": { "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "product_id": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-mail-doc@2.3.0-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "product": { "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "product_id": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-chunky_png@1.2.0-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch", "product": { "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch", "product_id": "rubygem-compass-0:0.11.5-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-compass@0.11.5-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "product": { "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "product_id": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-compass-960-plugin@0.10.4-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "product": { "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "product_id": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-compass-960-plugin-doc@0.10.4-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "product": { "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "product_id": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "product": { "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "product_id": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "product": { "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "product_id": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-net-ldap@0.1.1-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch", "product": { "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch", "product_id": "converge-ui-devel-0:1.0.4-1.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/converge-ui-devel@1.0.4-1.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "product": { "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "product_id": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-6.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "product": { "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "product_id": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-ldap_fluff@0.1.3-1.el6_3?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "puppet-0:2.6.17-2.el6cf.src", "product": { "name": "puppet-0:2.6.17-2.el6cf.src", "product_id": "puppet-0:2.6.17-2.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/puppet@2.6.17-2.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src", "product": { "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src", "product_id": "rubygem-activesupport-1:3.0.10-4.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-4.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src", "product": { "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src", "product_id": "rubygem-actionpack-1:3.0.10-10.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-10.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-mail-0:2.3.0-3.el6cf.src", "product": { "name": "rubygem-mail-0:2.3.0-3.el6cf.src", "product_id": "rubygem-mail-0:2.3.0-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-mail@2.3.0-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src", "product": { "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src", "product_id": "rubygem-chunky_png-0:1.2.0-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-chunky_png@1.2.0-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-compass-0:0.11.5-2.el6cf.src", "product": { "name": "rubygem-compass-0:0.11.5-2.el6cf.src", "product_id": "rubygem-compass-0:0.11.5-2.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-compass@0.11.5-2.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "product": { "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "product_id": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-compass-960-plugin@0.10.4-2.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src", "product": { "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src", "product_id": "rubygem-delayed_job-0:2.1.4-2.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-2.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src", "product": { "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src", "product_id": "rubygem-net-ldap-0:0.1.1-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-net-ldap@0.1.1-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "converge-ui-devel-0:1.0.4-1.el6cf.src", "product": { "name": "converge-ui-devel-0:1.0.4-1.el6cf.src", "product_id": "converge-ui-devel-0:1.0.4-1.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/converge-ui-devel@1.0.4-1.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src", "product": { "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src", "product_id": "rubygem-activerecord-1:3.0.10-6.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-6.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "product": { "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "product_id": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-ldap_fluff@0.1.3-1.el6_3?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch" }, "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "converge-ui-devel-0:1.0.4-1.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src" }, "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "puppet-0:2.6.17-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch" }, "product_reference": "puppet-0:2.6.17-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "puppet-0:2.6.17-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src" }, "product_reference": "puppet-0:2.6.17-2.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "puppet-server-0:2.6.17-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch" }, "product_reference": "puppet-server-0:2.6.17-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch" }, "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src" }, "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch" }, "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src" }, "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch" }, "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src" }, "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch" }, "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src" }, "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch" }, "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-0:0.11.5-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src" }, "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch" }, "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src" }, "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch" }, "product_reference": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src" }, "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch" }, "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src" }, "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch" }, "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-mail-0:2.3.0-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src" }, "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch" }, "product_reference": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch" }, "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" }, "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch" }, "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "converge-ui-devel-0:1.0.4-1.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src" }, "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "puppet-0:2.6.17-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch" }, "product_reference": "puppet-0:2.6.17-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "puppet-0:2.6.17-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src" }, "product_reference": "puppet-0:2.6.17-2.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "puppet-server-0:2.6.17-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch" }, "product_reference": "puppet-server-0:2.6.17-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch" }, "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src" }, "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch" }, "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src" }, "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch" }, "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src" }, "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch" }, "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src" }, "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch" }, "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-0:0.11.5-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src" }, "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch" }, "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src" }, "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch" }, "product_reference": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src" }, "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch" }, "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src" }, "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch" }, "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-mail-0:2.3.0-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src" }, "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch" }, "product_reference": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch" }, "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" }, "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Puppet Labs" ] } ], "cve": "CVE-2012-1986", "discovery_date": "2012-04-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "810069" } ], "notes": [ { "category": "description", "text": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.", "title": "Vulnerability description" }, { "category": "summary", "text": "puppet: Filebucket arbitrary file read", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-1986" }, { "category": "external", "summary": "RHBZ#810069", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810069" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-1986", "url": "https://www.cve.org/CVERecord?id=CVE-2012-1986" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1986", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1986" }, { "category": "external", "summary": "http://puppetlabs.com/security/cve/cve-2012-1986/", "url": "http://puppetlabs.com/security/cve/cve-2012-1986/" } ], "release_date": "2012-04-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 3.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "puppet: Filebucket arbitrary file read" }, { "acknowledgments": [ { "names": [ "Puppet Labs" ] } ], "cve": "CVE-2012-1987", "discovery_date": "2012-04-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "810070" } ], "notes": [ { "category": "description", "text": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations.", "title": "Vulnerability description" }, { "category": "summary", "text": "puppet: Filebucket denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-1987" }, { "category": "external", "summary": "RHBZ#810070", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810070" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-1987", "url": "https://www.cve.org/CVERecord?id=CVE-2012-1987" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1987", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1987" }, { "category": "external", "summary": "http://puppetlabs.com/security/cve/cve-2012-1987/", "url": "http://puppetlabs.com/security/cve/cve-2012-1987/" } ], "release_date": "2012-04-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "puppet: Filebucket denial of service" }, { "acknowledgments": [ { "names": [ "Puppet Labs" ] } ], "cve": "CVE-2012-1988", "discovery_date": "2012-04-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "810071" } ], "notes": [ { "category": "description", "text": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.", "title": "Vulnerability description" }, { "category": "summary", "text": "puppet: Filebucket arbitrary code execution", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-1988" }, { "category": "external", "summary": "RHBZ#810071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810071" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-1988", "url": "https://www.cve.org/CVERecord?id=CVE-2012-1988" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1988", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1988" }, { "category": "external", "summary": "http://puppetlabs.com/security/cve/cve-2012-1988/", "url": "http://puppetlabs.com/security/cve/cve-2012-1988/" } ], "release_date": "2012-04-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "puppet: Filebucket arbitrary code execution" }, { "cve": "CVE-2012-2139", "discovery_date": "2012-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "891762" } ], "notes": [ { "category": "description", "text": "Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-mail: directory traversal", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-2139" }, { "category": "external", "summary": "RHBZ#891762", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=891762" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2139", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2139" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2139", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2139" } ], "release_date": "2012-03-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "rubygem-mail: directory traversal" }, { "cve": "CVE-2012-2140", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)" }, "discovery_date": "2012-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "816352" } ], "notes": [ { "category": "description", "text": "The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-mail: arbitrary command execution when using exim or sendmail from commandline", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-2140" }, { "category": "external", "summary": "RHBZ#816352", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2140", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2140" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2140", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2140" } ], "release_date": "2012-03-14T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "rubygem-mail: arbitrary command execution when using exim or sendmail from commandline" }, { "cve": "CVE-2012-2660", "discovery_date": "2012-05-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "827353" } ], "notes": [ { "category": "description", "text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: Unsafe query generation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-2660" }, { "category": "external", "summary": "RHBZ#827353", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2660", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2660" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660" } ], "release_date": "2012-05-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "rubygem-actionpack: Unsafe query generation" }, { "cve": "CVE-2012-2661", "discovery_date": "2012-05-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "827363" } ], "notes": [ { "category": "description", "text": "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-activerecord: SQL injection when processing nested query paramaters", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-2661" }, { "category": "external", "summary": "RHBZ#827363", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2661", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2661" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661" } ], "release_date": "2012-05-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "rubygem-activerecord: SQL injection when processing nested query paramaters" }, { "cve": "CVE-2012-2694", "cwe": { "id": "CWE-305", "name": "Authentication Bypass by Primary Weakness" }, "discovery_date": "2012-06-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "831581" } ], "notes": [ { "category": "description", "text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[\u0027xyz\u0027, nil]\" values, a related issue to CVE-2012-2660.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-2694" }, { "category": "external", "summary": "RHBZ#831581", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2694", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2694" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694" } ], "release_date": "2012-06-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)" }, { "cve": "CVE-2012-2695", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)" }, "discovery_date": "2012-06-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "831573" } ], "notes": [ { "category": "description", "text": "The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-2695" }, { "category": "external", "summary": "RHBZ#831573", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2695", "url": "https://www.cve.org/CVERecord?id=CVE-2012-2695" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695" } ], "release_date": "2012-06-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)" }, { "cve": "CVE-2012-3424", "discovery_date": "2012-07-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "843711" } ], "notes": [ { "category": "description", "text": "The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-3424" }, { "category": "external", "summary": "RHBZ#843711", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3424", "url": "https://www.cve.org/CVERecord?id=CVE-2012-3424" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424" } ], "release_date": "2012-07-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest" }, { "cve": "CVE-2012-3463", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2012-08-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "847196" } ], "notes": [ { "category": "description", "text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-3463" }, { "category": "external", "summary": "RHBZ#847196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3463", "url": "https://www.cve.org/CVERecord?id=CVE-2012-3463" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463" } ], "release_date": "2012-08-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt" }, { "cve": "CVE-2012-3464", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2012-08-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "847199" } ], "notes": [ { "category": "description", "text": "Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a \u0027 (quote) character.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: potential XSS vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-3464" }, { "category": "external", "summary": "RHBZ#847199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3464", "url": "https://www.cve.org/CVERecord?id=CVE-2012-3464" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464" } ], "release_date": "2012-08-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: potential XSS vulnerability" }, { "cve": "CVE-2012-3465", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2012-08-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "847200" } ], "notes": [ { "category": "description", "text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: XSS Vulnerability in strip_tags", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-3465" }, { "category": "external", "summary": "RHBZ#847200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3465", "url": "https://www.cve.org/CVERecord?id=CVE-2012-3465" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465" } ], "release_date": "2012-08-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: XSS Vulnerability in strip_tags" }, { "acknowledgments": [ { "names": [ "Puppet Labs" ] } ], "cve": "CVE-2012-3864", "discovery_date": "2012-07-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "839130" } ], "notes": [ { "category": "description", "text": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request.", "title": "Vulnerability description" }, { "category": "summary", "text": "puppet: authenticated clients allowed to read arbitrary files from the puppet master", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-3864" }, { "category": "external", "summary": "RHBZ#839130", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3864", "url": "https://www.cve.org/CVERecord?id=CVE-2012-3864" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3864", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3864" }, { "category": "external", "summary": "http://puppetlabs.com/security/cve/cve-2012-3864/", "url": "http://puppetlabs.com/security/cve/cve-2012-3864/" } ], "release_date": "2012-07-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "puppet: authenticated clients allowed to read arbitrary files from the puppet master" }, { "acknowledgments": [ { "names": [ "Puppet Labs" ] } ], "cve": "CVE-2012-3865", "discovery_date": "2012-07-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "839131" } ], "notes": [ { "category": "description", "text": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.", "title": "Vulnerability description" }, { "category": "summary", "text": "puppet: authenticated clients allowed to delete arbitrary files on the puppet master", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-3865" }, { "category": "external", "summary": "RHBZ#839131", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3865", "url": "https://www.cve.org/CVERecord?id=CVE-2012-3865" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3865", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3865" }, { "category": "external", "summary": "http://puppetlabs.com/security/cve/cve-2012-3865/", "url": "http://puppetlabs.com/security/cve/cve-2012-3865/" } ], "release_date": "2012-07-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "puppet: authenticated clients allowed to delete arbitrary files on the puppet master" }, { "acknowledgments": [ { "names": [ "Puppet Labs" ] } ], "cve": "CVE-2012-3867", "discovery_date": "2012-07-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "839158" } ], "notes": [ { "category": "description", "text": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "puppet: insufficient validation of agent names in CN of SSL certificate requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-3867" }, { "category": "external", "summary": "RHBZ#839158", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3867", "url": "https://www.cve.org/CVERecord?id=CVE-2012-3867" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3867", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3867" }, { "category": "external", "summary": "http://puppetlabs.com/security/cve/cve-2012-3867/", "url": "http://puppetlabs.com/security/cve/cve-2012-3867/" } ], "release_date": "2012-07-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2012-12-04T19:24:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2012:1542" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch", "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src", "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch", "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src", "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch", "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch", "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "puppet: insufficient validation of agent names in CN of SSL certificate requests" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.