{"action":"Upgrade puppet to 2.7.18 or later.","affected":[{"fixed":"2.7.18","introduced":"2.7.0"}],"component":"puppet","cve_ids":["CVE-2012-3866"],"ecosystem":"RubyGems","epss":0.00481,"exploited":false,"fixed_versions":["2.7.18"],"ghsa_id":"GHSA-8jxj-9r5f-w3m2","id":"tcs_01M5KEJ2F6G3G5TTSD6YHP4XN5","modified_at":"2024-11-29T05:38:59.601360Z","published_at":"2017-10-24T18:33:37Z","references":["https://osv.dev/vulnerability/GHSA-8jxj-9r5f-w3m2","https://nvd.nist.gov/vuln/detail/CVE-2012-3866","https://github.com/puppetlabs/puppet/commit/fd44bf5e6d0d360f6a493d663b653c121fa83c3f","https://bugzilla.redhat.com/show_bug.cgi?id=839135","https://github.com/puppetlabs/puppet","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3866.yml","https://www.puppet.com/security/cve/cve-2012-3866-lastrunreportyaml-world-readable","http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html","http://puppetlabs.com/security/cve/cve-2012-3866","http://www.debian.org/security/2012/dsa-2511","http://www.ubuntu.com/usn/USN-1506-1"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-8jxj-9r5f-w3m2","url":"https://osv.dev/vulnerability/GHSA-8jxj-9r5f-w3m2"}],"summary":"Puppet allows local users to obtain sensitive configuration information"}