CVE-2012-3865: Path Traversal in Puppet Master

Successful exploitation of CVE-2012-3865 could lead to significant data loss and system compromise. An attacker, having valid credentials, could delete critical configuration files, Puppet code, or even system binaries, effectively disrupting Puppet's operation and potentially rendering the master server unusable. The ability to delete arbitrary files grants a high degree of control over the affected system. While requiring authentication, the impact is severe due to the potential for widespread disruption across managed nodes relying on the Puppet master.

1. Publicada2017-10-24
2. Modificada2024-11-29
3. EPSS actualizado2026-04-02

The primary mitigation for CVE-2012-3865 is to upgrade Puppet to version 2.6.17 or later. If upgrading immediately is not feasible, disable the 'Delete' feature in the auth.conf file. This will prevent remote users from deleting files, effectively eliminating the vulnerability. Consider implementing strict access controls and limiting user privileges within the Puppet environment to further reduce the attack surface. After upgrading, verify the fix by attempting to delete a test file using a user account with delete privileges; the operation should fail.