{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-07-11T00:00:00", "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-10-08T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "SUSE-SU-2012:0983", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"}, {"name": "DSA-2511", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2012/dsa-2511"}, {"name": "USN-1506-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1506-1"}, {"name": "50014", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/50014"}, {"name": "openSUSE-SU-2012:0891", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2012-3865", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "SUSE-SU-2012:0983", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"}, {"name": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f", "refsource": "CONFIRM", "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"}, {"name": "DSA-2511", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2511"}, {"name": "USN-1506-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1506-1"}, {"name": "50014", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/50014"}, {"name": "openSUSE-SU-2012:0891", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"}, {"name": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6", "refsource": "CONFIRM", "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=839131", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"}, {"name": "http://puppetlabs.com/security/cve/cve-2012-3865/", "refsource": "CONFIRM", "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T20:21:04.052Z"}, "title": "CVE Program Container", "references": [{"name": "SUSE-SU-2012:0983", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"}, {"name": "DSA-2511", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2012/dsa-2511"}, {"name": "USN-1506-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-1506-1"}, {"name": "50014", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/50014"}, {"name": "openSUSE-SU-2012:0891", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2012-3865", "datePublished": "2012-08-06T16:00:00", "dateReserved": "2012-07-06T00:00:00", "dateUpdated": "2024-08-06T20:21:04.052Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "BE56BA6B-BDC4-431E-81FD-D7ED5E8783E9", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "FDDDFB28-1971-4CCD-93D2-ABC08FE67F4A", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "508105B4-619A-4A9D-8B2F-FE5992C1006A", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*", "matchCriteriaId": "26DB96A5-A57D-452F-A452-98B11F51CAE6", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.6:*:*:*:*:*:*:*", "matchCriteriaId": "D33AF704-FA05-4EA8-BE95-0177871A810F", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.8:*:*:*:*:*:*:*", "matchCriteriaId": "07DE4213-E233-402E-88C2-B7FF8D7B682C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.9:*:*:*:*:*:*:*", "matchCriteriaId": "4122D8E3-24AD-4A55-9F89-C3AAD50E638D", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*", "matchCriteriaId": "AF6D6B90-62BA-4944-A699-6D7C48AFD0A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*", "matchCriteriaId": "8EC6A7B3-5949-4439-994A-68DA65438F5D", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*", "matchCriteriaId": "5140C34D-589C-43DB-BCA7-8434EB173205", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*", "matchCriteriaId": "E561C081-6262-46D3-AB17-01EEA6D3E988", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*", "matchCriteriaId": "4703802D-0E3A-4760-B660-6AE0AF74DD40", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*", "matchCriteriaId": "BE3D39F6-F9C8-4E7F-981A-265B04E85579", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*", "matchCriteriaId": "3A81EA6F-49C7-4883-8F93-E76A60DE1164", "versionEndIncluding": "2.7.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "1E5192CB-094F-469E-A644-2255C4F44804", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "D17D2752-CB0D-4CC8-8604-FEBF8DEE16E0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "9BEF50EE-4E4B-4641-BA34-B5024F1EF683", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "1CC72248-FD33-4CA0-A16E-0A174A864257", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*", "matchCriteriaId": "7CEFB16E-261F-4B81-BCBE-536CAD2EC44B", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*", "matchCriteriaId": "652D28FC-7133-4C5F-95D9-3468548465B5", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*", "matchCriteriaId": "AEEEE59D-BC0E-4107-B55D-9B182825E557", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*", "matchCriteriaId": "B4ED400E-48F7-475B-A87C-A14EC63DD93D", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*", "matchCriteriaId": "D827D4C2-7438-4EDD-9025-38D46CD5153C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*", "matchCriteriaId": "E73C341A-6C07-4820-B1D3-4616B634F380", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*", "matchCriteriaId": "61381D4C-972F-4979-84D2-793E4C60E23E", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*", "matchCriteriaId": "7D8C2A71-0277-4426-8627-D6FD275EFC62", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*", "matchCriteriaId": "3FB3C44C-2C6C-496C-9D2E-C43FFB493C42", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*", "matchCriteriaId": "AD2656B0-9606-477B-BEB3-35746218BF9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.12:*:*:*:*:*:*:*", "matchCriteriaId": "848F82FB-ACCE-42C0-A208-55522A030835", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.13:*:*:*:*:*:*:*", "matchCriteriaId": "B0BBFAA7-BB3F-49D2-975B-01194C66D7C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.14:*:*:*:*:*:*:*", "matchCriteriaId": "515BBBBF-7F42-490E-BF9D-B01AA3DD61C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet:2.6.15:*:*:*:*:*:*:*", "matchCriteriaId": "31C87FE4-D9E8-4619-9ADB-DFC2D3FE4FB6", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppetlabs:puppet:*:*:*:*:*:*:*:*", "matchCriteriaId": "BE6F41EF-556F-42E0-B26C-B96CD9C77B2B", "versionEndIncluding": "2.6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "matchCriteriaId": "F66C1E54-FBEA-4008-BC88-A390D415F3F5", "versionEndIncluding": "2.5.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."}, {"lang": "es", "value": "Vulnerabilidad de directorio transversal en lib/puppet/reports/store.rb en Puppet anterior a v2.6.17 y v2.7.x anterior a v2.7.18, y Puppet Enterprise anterior a v2.5.2, cuando Eliminar est\u00e1 habilitado en auth.conf, permite a usuarios remotos autenticados borrar archivos arbitrarios en el servidor maestro de las marionetas a trav\u00e9s de un .. (punto punto) en un nombre de nodo."}], "id": "CVE-2012-3865", "lastModified": "2024-11-21T01:41:45.757", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-08-06T16:55:06.070", "references": [{"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"}, {"source": "[email protected]", "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"}, {"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"}, {"source": "[email protected]", "url": "http://secunia.com/advisories/50014"}, {"source": "[email protected]", "url": "http://www.debian.org/security/2012/dsa-2511"}, {"source": "[email protected]", "url": "http://www.ubuntu.com/usn/USN-1506-1"}, {"source": "[email protected]", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"}, {"source": "[email protected]", "tags": ["Exploit", "Patch"], "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"}, {"source": "[email protected]", "tags": ["Exploit", "Patch"], "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/50014"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2012/dsa-2511"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-1506-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "[email protected]", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Puppet Labs for reporting this issue.", "affected_release": [{"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "converge-ui-devel-0:1.0.4-1.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "puppet-0:2.6.17-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-actionpack-1:3.0.10-10.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-activerecord-1:3.0.10-6.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-activesupport-1:3.0.10-4.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-chunky_png-0:1.2.0-3.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-compass-0:0.11.5-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-delayed_job-0:2.1.4-2.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-ldap_fluff-0:0.1.3-1.el6_3", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-mail-0:2.3.0-3.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}, {"advisory": "RHSA-2012:1542", "cpe": "cpe:/a:cloudforms_cloudengine:1::el6", "package": "rubygem-net-ldap-0:0.1.1-3.el6cf", "product_name": "CloudForms for RHEL 6", "release_date": "2012-12-04T00:00:00Z"}], "bugzilla": {"description": "puppet: authenticated clients allowed to delete arbitrary files on the puppet master", "id": "839131", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"}, "csaw": false, "cvss": {"cvss_base_score": "2.1", "cvss_scoring_vector": "AV:N/AC:H/Au:S/C:N/I:N/A:P", "status": "verified"}, "details": ["Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."], "name": "CVE-2012-3865", "package_state": [{"cpe": "cpe:/a:cloudforms_tools:1", "fix_state": "Affected", "package_name": "puppet", "product_name": "Red Hat CloudForms Tools 1"}, {"cpe": "cpe:/a:redhat:enterprise_mrg:1", "fix_state": "Will not fix", "package_name": "puppet", "product_name": "Red Hat Enterprise MRG 1"}], "public_date": "2012-07-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-3865\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-3865\nhttp://puppetlabs.com/security/cve/cve-2012-3865/"], "threat_severity": "Low", "upstream_fix": "puppet 2.6.17, puppet 2.7.18"}