CVE-2012-1054: Puppet

Medium severity, CVSS 4.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.

Affected products

• Puppet Puppet: version 2.6.0 only; version 2.6.1 only; version 2.6.2 only; version 2.6.3 only; version 2.6.4 only; version 2.6.5 only; …
• Puppet Puppet Enterprise: version 1.2.0 only; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.4 only; version 2.0.0 only; …
• Puppetlabs Puppet: version 2.7.0 only; version 2.7.1 only
• Puppetlabs Puppet Enterprise Users: version 1.0 only; version 1.1 only

Published 2012-05-29. Last modified 2026-06-16.