CVE-2012-1989
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- puppet:puppet
- puppet:puppet_enterprise
- puppetlabs:puppet
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-c5qq-g673-5p49 | RubyGems | puppet | >=2.7.1 <2.7.13 | 2.7.13 |