CVE-2011-3872

no score yetEPSS 2.5%

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2011-10-27
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet
puppet:puppet_enterprise
puppetlabs:puppet
puppetlabs:puppet_enterprise_users

References

http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1
http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/
http://secunia.com/advisories/46550
http://secunia.com/advisories/46578
http://secunia.com/advisories/46934

Check your stack JSON