rhsa-2012_1542
Vulnerability from csaf_redhat
Published
2012-12-04 19:24
Modified
2024-11-22 06:14
Summary
Red Hat Security Advisory: CloudForms Commons 1.1 security update
Notes
Topic
Updated CloudForms Commons packages that fix several security issues are
now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat CloudForms is an on-premise hybrid cloud
Infrastructure-as-a-Service (IaaS) product that lets you create and manage
private and public clouds.
Multiple input validation vulnerabilities were discovered in
rubygem-activerecored. A remote attacker could possibly use these flaws
to perform an SQL injection attack against an application using
rubygem-activerecord. (CVE-2012-2660, CVE-2012-2661, CVE-2012-2694,
CVE-2012-2695)
Multiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.
A remote attacker could use these flaws to conduct XSS attacks against
users of an application using rubygem-actionpack. (CVE-2012-3463,
CVE-2012-3464, CVE-2012-3465)
A flaw was found in the HTTP digest authentication implementation in
rubygem-actionpack. A remote attacker could use this flaw to cause a
denial of service of an application using rubygem-actionpack and digest
authentication. (CVE-2012-3424)
An input validation flaw was found in rubygem-mail's Exim and Sendmail
delivery methods. A remote attacker could use this flaw to execute
arbitrary commands with the privileges of an application using
rubygem-mail. (CVE-2012-2140)
A directory traversal flaw was found in rubygem-mail's file delivery
method. A remote attacker could use this flaw to send a mail with a
specially crafted To: header and write to files with the privileges of
an application using rubygem-mail. (CVE-2012-2139)
Puppet was updated to version 2.6.17, which fixes multiple security
issues. These issues are not exposed by CloudForms. (CVE-2012-1986,
CVE-2012-1987, CVE-2012-1988, CVE-2012-3864, CVE-2012-3865, CVE-2012-3867)
Red Hat would like to thank Puppet Labs for reporting CVE-2012-1988,
CVE-2012-1986, CVE-2012-1987, CVE-2012-3864, CVE-2012-3865, and
CVE-2012-3867.
Users are advised to upgrade to these CloudForms Commons packages, which
resolve these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated CloudForms Commons packages that fix several security issues are\nnow available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat CloudForms is an on-premise hybrid cloud\nInfrastructure-as-a-Service (IaaS) product that lets you create and manage\nprivate and public clouds.\n\nMultiple input validation vulnerabilities were discovered in\nrubygem-activerecored. A remote attacker could possibly use these flaws\nto perform an SQL injection attack against an application using\nrubygem-activerecord. (CVE-2012-2660, CVE-2012-2661, CVE-2012-2694,\nCVE-2012-2695)\n\nMultiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.\nA remote attacker could use these flaws to conduct XSS attacks against\nusers of an application using rubygem-actionpack. (CVE-2012-3463,\nCVE-2012-3464, CVE-2012-3465)\n\nA flaw was found in the HTTP digest authentication implementation in\nrubygem-actionpack. A remote attacker could use this flaw to cause a\ndenial of service of an application using rubygem-actionpack and digest\nauthentication. (CVE-2012-3424)\n\nAn input validation flaw was found in rubygem-mail\u0027s Exim and Sendmail\ndelivery methods. A remote attacker could use this flaw to execute\narbitrary commands with the privileges of an application using\nrubygem-mail. (CVE-2012-2140)\n\nA directory traversal flaw was found in rubygem-mail\u0027s file delivery\nmethod. A remote attacker could use this flaw to send a mail with a\nspecially crafted To: header and write to files with the privileges of\nan application using rubygem-mail. (CVE-2012-2139)\n\nPuppet was updated to version 2.6.17, which fixes multiple security\nissues. These issues are not exposed by CloudForms. (CVE-2012-1986,\nCVE-2012-1987, CVE-2012-1988, CVE-2012-3864, CVE-2012-3865, CVE-2012-3867)\n\nRed Hat would like to thank Puppet Labs for reporting CVE-2012-1988,\nCVE-2012-1986, CVE-2012-1987, CVE-2012-3864, CVE-2012-3865, and\nCVE-2012-3867.\n\nUsers are advised to upgrade to these CloudForms Commons packages, which\nresolve these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2012:1542",
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "810069",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=810069"
},
{
"category": "external",
"summary": "810070",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=810070"
},
{
"category": "external",
"summary": "810071",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=810071"
},
{
"category": "external",
"summary": "816352",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
},
{
"category": "external",
"summary": "827353",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353"
},
{
"category": "external",
"summary": "827363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363"
},
{
"category": "external",
"summary": "831573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573"
},
{
"category": "external",
"summary": "831581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581"
},
{
"category": "external",
"summary": "839130",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
},
{
"category": "external",
"summary": "839131",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
},
{
"category": "external",
"summary": "839158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
},
{
"category": "external",
"summary": "843711",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711"
},
{
"category": "external",
"summary": "847196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196"
},
{
"category": "external",
"summary": "847199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199"
},
{
"category": "external",
"summary": "847200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1542.json"
}
],
"title": "Red Hat Security Advisory: CloudForms Commons 1.1 security update",
"tracking": {
"current_release_date": "2024-11-22T06:14:07+00:00",
"generator": {
"date": "2024-11-22T06:14:07+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2012:1542",
"initial_release_date": "2012-12-04T19:24:00+00:00",
"revision_history": [
{
"date": "2012-12-04T19:24:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2012-12-04T19:29:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T06:14:07+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "CloudForms Cloud Engine for RHEL 6 Server",
"product": {
"name": "CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine",
"product_identification_helper": {
"cpe": "cpe:/a:cloudforms_cloudengine:1::el6"
}
}
},
{
"category": "product_name",
"name": "CloudForms System Engine for RHEL 6 Server",
"product": {
"name": "CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine",
"product_identification_helper": {
"cpe": "cpe:/a:cloudforms_systemengine:1::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat CloudForms"
},
{
"branches": [
{
"category": "product_version",
"name": "puppet-server-0:2.6.17-2.el6cf.noarch",
"product": {
"name": "puppet-server-0:2.6.17-2.el6cf.noarch",
"product_id": "puppet-server-0:2.6.17-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/puppet-server@2.6.17-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "puppet-0:2.6.17-2.el6cf.noarch",
"product": {
"name": "puppet-0:2.6.17-2.el6cf.noarch",
"product_id": "puppet-0:2.6.17-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/puppet@2.6.17-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"product": {
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"product_id": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-4.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"product": {
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"product_id": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-10.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
"product": {
"name": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
"product_id": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-mail@2.3.0-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"product": {
"name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"product_id": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-mail-doc@2.3.0-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"product": {
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"product_id": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-chunky_png@1.2.0-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
"product": {
"name": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
"product_id": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-compass@0.11.5-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"product": {
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"product_id": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-compass-960-plugin@0.10.4-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"product": {
"name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"product_id": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-compass-960-plugin-doc@0.10.4-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"product": {
"name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"product_id": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"product": {
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"product_id": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"product": {
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"product_id": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-net-ldap@0.1.1-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"product": {
"name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"product_id": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/converge-ui-devel@1.0.4-1.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"product": {
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"product_id": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-6.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"product": {
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"product_id": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-ldap_fluff@0.1.3-1.el6_3?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "puppet-0:2.6.17-2.el6cf.src",
"product": {
"name": "puppet-0:2.6.17-2.el6cf.src",
"product_id": "puppet-0:2.6.17-2.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/puppet@2.6.17-2.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
"product": {
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
"product_id": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-4.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
"product": {
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
"product_id": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-10.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-mail-0:2.3.0-3.el6cf.src",
"product": {
"name": "rubygem-mail-0:2.3.0-3.el6cf.src",
"product_id": "rubygem-mail-0:2.3.0-3.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-mail@2.3.0-3.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"product": {
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"product_id": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-chunky_png@1.2.0-3.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-compass-0:0.11.5-2.el6cf.src",
"product": {
"name": "rubygem-compass-0:0.11.5-2.el6cf.src",
"product_id": "rubygem-compass-0:0.11.5-2.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-compass@0.11.5-2.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"product": {
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"product_id": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-compass-960-plugin@0.10.4-2.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"product": {
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"product_id": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-2.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"product": {
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"product_id": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-net-ldap@0.1.1-3.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "converge-ui-devel-0:1.0.4-1.el6cf.src",
"product": {
"name": "converge-ui-devel-0:1.0.4-1.el6cf.src",
"product_id": "converge-ui-devel-0:1.0.4-1.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/converge-ui-devel@1.0.4-1.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
"product": {
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
"product_id": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-6.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"product": {
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"product_id": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-ldap_fluff@0.1.3-1.el6_3?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch"
},
"product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "converge-ui-devel-0:1.0.4-1.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src"
},
"product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "puppet-0:2.6.17-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch"
},
"product_reference": "puppet-0:2.6.17-2.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "puppet-0:2.6.17-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src"
},
"product_reference": "puppet-0:2.6.17-2.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "puppet-server-0:2.6.17-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch"
},
"product_reference": "puppet-server-0:2.6.17-2.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch"
},
"product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src"
},
"product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch"
},
"product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src"
},
"product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch"
},
"product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src"
},
"product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch"
},
"product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src"
},
"product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-0:0.11.5-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch"
},
"product_reference": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-0:0.11.5-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src"
},
"product_reference": "rubygem-compass-0:0.11.5-2.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch"
},
"product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src"
},
"product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch"
},
"product_reference": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch"
},
"product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src"
},
"product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch"
},
"product_reference": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch"
},
"product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src"
},
"product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-mail-0:2.3.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch"
},
"product_reference": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-mail-0:2.3.0-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src"
},
"product_reference": "rubygem-mail-0:2.3.0-3.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch"
},
"product_reference": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch"
},
"product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
},
"product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch"
},
"product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "converge-ui-devel-0:1.0.4-1.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src"
},
"product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "puppet-0:2.6.17-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch"
},
"product_reference": "puppet-0:2.6.17-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "puppet-0:2.6.17-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src"
},
"product_reference": "puppet-0:2.6.17-2.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "puppet-server-0:2.6.17-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch"
},
"product_reference": "puppet-server-0:2.6.17-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch"
},
"product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-10.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src"
},
"product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch"
},
"product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-6.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src"
},
"product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch"
},
"product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-4.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src"
},
"product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch"
},
"product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src"
},
"product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-0:0.11.5-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch"
},
"product_reference": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-0:0.11.5-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src"
},
"product_reference": "rubygem-compass-0:0.11.5-2.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch"
},
"product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src"
},
"product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch"
},
"product_reference": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch"
},
"product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src"
},
"product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch"
},
"product_reference": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch"
},
"product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src"
},
"product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-mail-0:2.3.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch"
},
"product_reference": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-mail-0:2.3.0-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src"
},
"product_reference": "rubygem-mail-0:2.3.0-3.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch"
},
"product_reference": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch"
},
"product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
},
"product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Puppet Labs"
]
}
],
"cve": "CVE-2012-1986",
"discovery_date": "2012-04-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "810069"
}
],
"notes": [
{
"category": "description",
"text": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "puppet: Filebucket arbitrary file read",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-1986"
},
{
"category": "external",
"summary": "RHBZ#810069",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=810069"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-1986",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-1986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1986"
},
{
"category": "external",
"summary": "http://puppetlabs.com/security/cve/cve-2012-1986/",
"url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
}
],
"release_date": "2012-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "puppet: Filebucket arbitrary file read"
},
{
"acknowledgments": [
{
"names": [
"Puppet Labs"
]
}
],
"cve": "CVE-2012-1987",
"discovery_date": "2012-04-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "810070"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "puppet: Filebucket denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-1987"
},
{
"category": "external",
"summary": "RHBZ#810070",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=810070"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-1987",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-1987"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1987",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1987"
},
{
"category": "external",
"summary": "http://puppetlabs.com/security/cve/cve-2012-1987/",
"url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
}
],
"release_date": "2012-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "puppet: Filebucket denial of service"
},
{
"acknowledgments": [
{
"names": [
"Puppet Labs"
]
}
],
"cve": "CVE-2012-1988",
"discovery_date": "2012-04-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "810071"
}
],
"notes": [
{
"category": "description",
"text": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "puppet: Filebucket arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-1988"
},
{
"category": "external",
"summary": "RHBZ#810071",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=810071"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-1988",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-1988"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1988",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1988"
},
{
"category": "external",
"summary": "http://puppetlabs.com/security/cve/cve-2012-1988/",
"url": "http://puppetlabs.com/security/cve/cve-2012-1988/"
}
],
"release_date": "2012-04-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "puppet: Filebucket arbitrary code execution"
},
{
"cve": "CVE-2012-2139",
"discovery_date": "2012-04-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "891762"
}
],
"notes": [
{
"category": "description",
"text": "Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-mail: directory traversal",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2139"
},
{
"category": "external",
"summary": "RHBZ#891762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=891762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2139",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2139"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2139",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2139"
}
],
"release_date": "2012-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-mail: directory traversal"
},
{
"cve": "CVE-2012-2140",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2012-04-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "816352"
}
],
"notes": [
{
"category": "description",
"text": "The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-mail: arbitrary command execution when using exim or sendmail from commandline",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2140"
},
{
"category": "external",
"summary": "RHBZ#816352",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2140",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2140"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2140",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2140"
}
],
"release_date": "2012-03-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rubygem-mail: arbitrary command execution when using exim or sendmail from commandline"
},
{
"cve": "CVE-2012-2660",
"discovery_date": "2012-05-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "827353"
}
],
"notes": [
{
"category": "description",
"text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: Unsafe query generation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2660"
},
{
"category": "external",
"summary": "RHBZ#827353",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2660",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2660"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660"
}
],
"release_date": "2012-05-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-actionpack: Unsafe query generation"
},
{
"cve": "CVE-2012-2661",
"discovery_date": "2012-05-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "827363"
}
],
"notes": [
{
"category": "description",
"text": "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: SQL injection when processing nested query paramaters",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2661"
},
{
"category": "external",
"summary": "RHBZ#827363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2661",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2661"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661"
}
],
"release_date": "2012-05-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-activerecord: SQL injection when processing nested query paramaters"
},
{
"cve": "CVE-2012-2694",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2012-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "831581"
}
],
"notes": [
{
"category": "description",
"text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[\u0027xyz\u0027, nil]\" values, a related issue to CVE-2012-2660.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2694"
},
{
"category": "external",
"summary": "RHBZ#831581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2694",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2694"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694"
}
],
"release_date": "2012-06-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)"
},
{
"cve": "CVE-2012-2695",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2012-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "831573"
}
],
"notes": [
{
"category": "description",
"text": "The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2695"
},
{
"category": "external",
"summary": "RHBZ#831573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2695",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2695"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695"
}
],
"release_date": "2012-06-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)"
},
{
"cve": "CVE-2012-3424",
"discovery_date": "2012-07-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "843711"
}
],
"notes": [
{
"category": "description",
"text": "The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3424"
},
{
"category": "external",
"summary": "RHBZ#843711",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3424",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3424"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424"
}
],
"release_date": "2012-07-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest"
},
{
"cve": "CVE-2012-3463",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2012-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "847196"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3463"
},
{
"category": "external",
"summary": "RHBZ#847196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3463",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3463"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463"
}
],
"release_date": "2012-08-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt"
},
{
"cve": "CVE-2012-3464",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2012-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "847199"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a \u0027 (quote) character.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: potential XSS vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3464"
},
{
"category": "external",
"summary": "RHBZ#847199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3464",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464"
}
],
"release_date": "2012-08-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionpack: potential XSS vulnerability"
},
{
"cve": "CVE-2012-3465",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2012-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "847200"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: XSS Vulnerability in strip_tags",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3465"
},
{
"category": "external",
"summary": "RHBZ#847200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3465",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465"
}
],
"release_date": "2012-08-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionpack: XSS Vulnerability in strip_tags"
},
{
"acknowledgments": [
{
"names": [
"Puppet Labs"
]
}
],
"cve": "CVE-2012-3864",
"discovery_date": "2012-07-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "839130"
}
],
"notes": [
{
"category": "description",
"text": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "puppet: authenticated clients allowed to read arbitrary files from the puppet master",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3864"
},
{
"category": "external",
"summary": "RHBZ#839130",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3864",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3864"
},
{
"category": "external",
"summary": "http://puppetlabs.com/security/cve/cve-2012-3864/",
"url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
}
],
"release_date": "2012-07-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "puppet: authenticated clients allowed to read arbitrary files from the puppet master"
},
{
"acknowledgments": [
{
"names": [
"Puppet Labs"
]
}
],
"cve": "CVE-2012-3865",
"discovery_date": "2012-07-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "839131"
}
],
"notes": [
{
"category": "description",
"text": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "puppet: authenticated clients allowed to delete arbitrary files on the puppet master",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3865"
},
{
"category": "external",
"summary": "RHBZ#839131",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3865",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3865"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3865",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3865"
},
{
"category": "external",
"summary": "http://puppetlabs.com/security/cve/cve-2012-3865/",
"url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
}
],
"release_date": "2012-07-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "puppet: authenticated clients allowed to delete arbitrary files on the puppet master"
},
{
"acknowledgments": [
{
"names": [
"Puppet Labs"
]
}
],
"cve": "CVE-2012-3867",
"discovery_date": "2012-07-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "839158"
}
],
"notes": [
{
"category": "description",
"text": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "puppet: insufficient validation of agent names in CN of SSL certificate requests",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3867"
},
{
"category": "external",
"summary": "RHBZ#839158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3867",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3867"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3867",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3867"
},
{
"category": "external",
"summary": "http://puppetlabs.com/security/cve/cve-2012-3867/",
"url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
}
],
"release_date": "2012-07-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2012-12-04T19:24:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2012:1542"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
"6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
"6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
"6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
"6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
"6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
"6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "puppet: insufficient validation of agent names in CN of SSL certificate requests"
}
]
}
Loading...
Loading...
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.