{"action":"Upgrade puppet to 2.6.15 or later.","affected":[{"fixed":"2.6.15","introduced":"2.6"},{"fixed":"2.7.13","introduced":"2.7"}],"component":"puppet","cve_ids":["CVE-2012-1906"],"ecosystem":"RubyGems","epss":0.0035,"exploited":false,"fixed_versions":["2.6.15","2.7.13"],"ghsa_id":"GHSA-c4mc-49hq-q275","id":"tcs_01M5KEJM8ZF7R529J08D1VARV1","modified_at":"2024-11-28T05:38:52.671592Z","published_at":"2022-05-14T00:56:45Z","references":["https://osv.dev/vulnerability/GHSA-c4mc-49hq-q275","https://nvd.nist.gov/vuln/detail/CVE-2012-1906","https://github.com/puppetlabs/puppet/commit/f7829ec1f1b2c3def8e0eda09c22c3c1fed3a27f","https://exchange.xforce.ibmcloud.com/vulnerabilities/74793","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-1906.yml","https://ubuntu.com/usn/usn-1419-1","https://web.archive.org/web/20120415105345/http://www.securityfocus.com/bid/52975","https://www.debian.org/security/2012/dsa-2451","http://projects.puppetlabs.com/issues/13260","http://puppetlabs.com/security/cve/cve-2012-1906"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-c4mc-49hq-q275","url":"https://osv.dev/vulnerability/GHSA-c4mc-49hq-q275"}],"summary":"Puppet uses predictable filenames, allowing arbitrary file overwrite"}