{"action":"Upgrade puppet to 2.7.18 or later.","affected":[{"fixed":"2.7.18","introduced":"0"}],"component":"puppet","cve_ids":["CVE-2012-3408"],"ecosystem":"RubyGems","epss":0.01641,"exploited":false,"fixed_versions":["2.7.18"],"ghsa_id":"GHSA-vxf6-w9mp-95hm","id":"tcs_01M5KENR42A9KZ5RJ8XQ95K12J","modified_at":"2024-11-29T05:41:49.425196Z","published_at":"2017-10-24T18:33:38Z","references":["https://osv.dev/vulnerability/GHSA-vxf6-w9mp-95hm","https://nvd.nist.gov/vuln/detail/CVE-2012-3408","https://github.com/puppetlabs/puppet/commit/ab9150baa1b738467a33b01df1d90e076253fbbd","https://bugzilla.redhat.com/show_bug.cgi?id=839166","https://github.com/puppetlabs/puppet","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2012-3408.yml","https://www.puppet.com/security/cve/cve-2012-3408-agent-impersonation","http://puppetlabs.com/security/cve/cve-2012-3408"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-vxf6-w9mp-95hm","url":"https://osv.dev/vulnerability/GHSA-vxf6-w9mp-95hm"}],"summary":"Puppet supports use of IP addresses in certnames without warning of potential risks"}