csaf_redhat - RHSA-2012:1542

RHSA-2012:1542

Vulnerability from csaf_redhat

Published

2012-12-04 19:24

Modified

2025-10-28 01:40

Summary

Red Hat Security Advisory: CloudForms Commons 1.1 security update

Notes

Topic

Updated CloudForms Commons packages that fix several security issues are now available. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Details

Red Hat CloudForms is an on-premise hybrid cloud Infrastructure-as-a-Service (IaaS) product that lets you create and manage private and public clouds. Multiple input validation vulnerabilities were discovered in rubygem-activerecored. A remote attacker could possibly use these flaws to perform an SQL injection attack against an application using rubygem-activerecord. (CVE-2012-2660, CVE-2012-2661, CVE-2012-2694, CVE-2012-2695) Multiple cross-site scripting (XSS) flaws were found in rubygem-actionpack. A remote attacker could use these flaws to conduct XSS attacks against users of an application using rubygem-actionpack. (CVE-2012-3463, CVE-2012-3464, CVE-2012-3465) A flaw was found in the HTTP digest authentication implementation in rubygem-actionpack. A remote attacker could use this flaw to cause a denial of service of an application using rubygem-actionpack and digest authentication. (CVE-2012-3424) An input validation flaw was found in rubygem-mail's Exim and Sendmail delivery methods. A remote attacker could use this flaw to execute arbitrary commands with the privileges of an application using rubygem-mail. (CVE-2012-2140) A directory traversal flaw was found in rubygem-mail's file delivery method. A remote attacker could use this flaw to send a mail with a specially crafted To: header and write to files with the privileges of an application using rubygem-mail. (CVE-2012-2139) Puppet was updated to version 2.6.17, which fixes multiple security issues. These issues are not exposed by CloudForms. (CVE-2012-1986, CVE-2012-1987, CVE-2012-1988, CVE-2012-3864, CVE-2012-3865, CVE-2012-3867) Red Hat would like to thank Puppet Labs for reporting CVE-2012-1988, CVE-2012-1986, CVE-2012-1987, CVE-2012-3864, CVE-2012-3865, and CVE-2012-3867. Users are advised to upgrade to these CloudForms Commons packages, which resolve these issues.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated CloudForms Commons packages that fix several security issues are\nnow available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms is an on-premise hybrid cloud\nInfrastructure-as-a-Service (IaaS) product that lets you create and manage\nprivate and public clouds.\n\nMultiple input validation vulnerabilities were discovered in\nrubygem-activerecored. A remote attacker could possibly use these flaws\nto perform an SQL injection attack against an application using\nrubygem-activerecord. (CVE-2012-2660, CVE-2012-2661, CVE-2012-2694,\nCVE-2012-2695)\n\nMultiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.\nA remote attacker could use these flaws to conduct XSS attacks against\nusers of an application using rubygem-actionpack. (CVE-2012-3463,\nCVE-2012-3464, CVE-2012-3465)\n\nA flaw was found in the HTTP digest authentication implementation in\nrubygem-actionpack. A remote attacker could use this flaw to cause a\ndenial of service of an application using rubygem-actionpack and digest\nauthentication. (CVE-2012-3424)\n\nAn input validation flaw was found in rubygem-mail\u0027s Exim and Sendmail\ndelivery methods. A remote attacker could use this flaw to execute\narbitrary commands with the privileges of an application using\nrubygem-mail. (CVE-2012-2140)\n\nA directory traversal flaw was found in rubygem-mail\u0027s file delivery\nmethod. A remote attacker could use this flaw to send a mail with a\nspecially crafted To: header and write to files with the privileges of\nan application using rubygem-mail. (CVE-2012-2139)\n\nPuppet was updated to version 2.6.17, which fixes multiple security\nissues. These issues are not exposed by CloudForms. (CVE-2012-1986,\nCVE-2012-1987, CVE-2012-1988, CVE-2012-3864, CVE-2012-3865, CVE-2012-3867)\n\nRed Hat would like to thank Puppet Labs for reporting CVE-2012-1988,\nCVE-2012-1986, CVE-2012-1987, CVE-2012-3864, CVE-2012-3865, and\nCVE-2012-3867.\n\nUsers are advised to upgrade to these CloudForms Commons packages, which\nresolve these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2012:1542",
        "url": "https://access.redhat.com/errata/RHSA-2012:1542"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "810069",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810069"
      },
      {
        "category": "external",
        "summary": "810070",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810070"
      },
      {
        "category": "external",
        "summary": "810071",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810071"
      },
      {
        "category": "external",
        "summary": "816352",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
      },
      {
        "category": "external",
        "summary": "827353",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353"
      },
      {
        "category": "external",
        "summary": "827363",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363"
      },
      {
        "category": "external",
        "summary": "831573",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573"
      },
      {
        "category": "external",
        "summary": "831581",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581"
      },
      {
        "category": "external",
        "summary": "839130",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
      },
      {
        "category": "external",
        "summary": "839131",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
      },
      {
        "category": "external",
        "summary": "839158",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
      },
      {
        "category": "external",
        "summary": "843711",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711"
      },
      {
        "category": "external",
        "summary": "847196",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196"
      },
      {
        "category": "external",
        "summary": "847199",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199"
      },
      {
        "category": "external",
        "summary": "847200",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1542.json"
      }
    ],
    "title": "Red Hat Security Advisory: CloudForms Commons 1.1 security update",
    "tracking": {
      "current_release_date": "2025-10-28T01:40:32+00:00",
      "generator": {
        "date": "2025-10-28T01:40:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.10"
        }
      },
      "id": "RHSA-2012:1542",
      "initial_release_date": "2012-12-04T19:24:00+00:00",
      "revision_history": [
        {
          "date": "2012-12-04T19:24:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2012-12-04T19:29:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-10-28T01:40:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudForms Cloud Engine for RHEL 6 Server",
                "product": {
                  "name": "CloudForms Cloud Engine for RHEL 6 Server",
                  "product_id": "6Server-CloudEngine",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudforms_cloudengine:1::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "CloudForms System Engine for RHEL 6 Server",
                "product": {
                  "name": "CloudForms System Engine for RHEL 6 Server",
                  "product_id": "6Server-SystemEngine",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:cloudforms_systemengine:1::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "puppet-server-0:2.6.17-2.el6cf.noarch",
                "product": {
                  "name": "puppet-server-0:2.6.17-2.el6cf.noarch",
                  "product_id": "puppet-server-0:2.6.17-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/puppet-server@2.6.17-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "puppet-0:2.6.17-2.el6cf.noarch",
                "product": {
                  "name": "puppet-0:2.6.17-2.el6cf.noarch",
                  "product_id": "puppet-0:2.6.17-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/puppet@2.6.17-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
                "product": {
                  "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
                  "product_id": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-4.el6cf?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
                "product": {
                  "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
                  "product_id": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-10.el6cf?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
                  "product_id": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-mail@2.3.0-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
                  "product_id": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-mail-doc@2.3.0-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
                  "product_id": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-chunky_png@1.2.0-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
                "product": {
                  "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
                  "product_id": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-compass@0.11.5-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
                "product": {
                  "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
                  "product_id": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-compass-960-plugin@0.10.4-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
                "product": {
                  "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
                  "product_id": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-compass-960-plugin-doc@0.10.4-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
                "product": {
                  "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
                  "product_id": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
                "product": {
                  "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
                  "product_id": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-2.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
                "product": {
                  "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
                  "product_id": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-net-ldap@0.1.1-3.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
                "product": {
                  "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
                  "product_id": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/converge-ui-devel@1.0.4-1.el6cf?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
                "product": {
                  "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
                  "product_id": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-6.el6cf?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
                "product": {
                  "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
                  "product_id": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-ldap_fluff@0.1.3-1.el6_3?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "puppet-0:2.6.17-2.el6cf.src",
                "product": {
                  "name": "puppet-0:2.6.17-2.el6cf.src",
                  "product_id": "puppet-0:2.6.17-2.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/puppet@2.6.17-2.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
                "product": {
                  "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
                  "product_id": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-4.el6cf?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
                "product": {
                  "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
                  "product_id": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-10.el6cf?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-mail-0:2.3.0-3.el6cf.src",
                "product": {
                  "name": "rubygem-mail-0:2.3.0-3.el6cf.src",
                  "product_id": "rubygem-mail-0:2.3.0-3.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-mail@2.3.0-3.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
                "product": {
                  "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
                  "product_id": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-chunky_png@1.2.0-3.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-compass-0:0.11.5-2.el6cf.src",
                "product": {
                  "name": "rubygem-compass-0:0.11.5-2.el6cf.src",
                  "product_id": "rubygem-compass-0:0.11.5-2.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-compass@0.11.5-2.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
                "product": {
                  "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
                  "product_id": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-compass-960-plugin@0.10.4-2.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
                "product": {
                  "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
                  "product_id": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-2.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
                "product": {
                  "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
                  "product_id": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-net-ldap@0.1.1-3.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "converge-ui-devel-0:1.0.4-1.el6cf.src",
                "product": {
                  "name": "converge-ui-devel-0:1.0.4-1.el6cf.src",
                  "product_id": "converge-ui-devel-0:1.0.4-1.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/converge-ui-devel@1.0.4-1.el6cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
                "product": {
                  "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
                  "product_id": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-6.el6cf?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
                "product": {
                  "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
                  "product_id": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rubygem-ldap_fluff@0.1.3-1.el6_3?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch"
        },
        "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "converge-ui-devel-0:1.0.4-1.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src"
        },
        "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-0:2.6.17-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch"
        },
        "product_reference": "puppet-0:2.6.17-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-0:2.6.17-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src"
        },
        "product_reference": "puppet-0:2.6.17-2.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-server-0:2.6.17-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch"
        },
        "product_reference": "puppet-server-0:2.6.17-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch"
        },
        "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src"
        },
        "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch"
        },
        "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src"
        },
        "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch"
        },
        "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src"
        },
        "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch"
        },
        "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src"
        },
        "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch"
        },
        "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-0:0.11.5-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src"
        },
        "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src"
        },
        "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src"
        },
        "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch"
        },
        "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src"
        },
        "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch"
        },
        "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-mail-0:2.3.0-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src"
        },
        "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch"
        },
        "product_reference": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch"
        },
        "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
          "product_id": "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        },
        "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
        "relates_to_product_reference": "6Server-CloudEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "converge-ui-devel-0:1.0.4-1.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch"
        },
        "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "converge-ui-devel-0:1.0.4-1.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src"
        },
        "product_reference": "converge-ui-devel-0:1.0.4-1.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-0:2.6.17-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch"
        },
        "product_reference": "puppet-0:2.6.17-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-0:2.6.17-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src"
        },
        "product_reference": "puppet-0:2.6.17-2.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "puppet-server-0:2.6.17-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch"
        },
        "product_reference": "puppet-server-0:2.6.17-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch"
        },
        "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-actionpack-1:3.0.10-10.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src"
        },
        "product_reference": "rubygem-actionpack-1:3.0.10-10.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch"
        },
        "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activerecord-1:3.0.10-6.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src"
        },
        "product_reference": "rubygem-activerecord-1:3.0.10-6.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch"
        },
        "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-activesupport-1:3.0.10-4.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src"
        },
        "product_reference": "rubygem-activesupport-1:3.0.10-4.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch"
        },
        "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-chunky_png-0:1.2.0-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src"
        },
        "product_reference": "rubygem-chunky_png-0:1.2.0-3.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-0:0.11.5-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch"
        },
        "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-0:0.11.5-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src"
        },
        "product_reference": "rubygem-compass-0:0.11.5-2.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src"
        },
        "product_reference": "rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-0:2.1.4-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src"
        },
        "product_reference": "rubygem-delayed_job-0:2.1.4-2.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch"
        },
        "product_reference": "rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch"
        },
        "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src"
        },
        "product_reference": "rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-mail-0:2.3.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch"
        },
        "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-mail-0:2.3.0-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src"
        },
        "product_reference": "rubygem-mail-0:2.3.0-3.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch"
        },
        "product_reference": "rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch"
        },
        "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
        "relates_to_product_reference": "6Server-SystemEngine"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rubygem-net-ldap-0:0.1.1-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
          "product_id": "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        },
        "product_reference": "rubygem-net-ldap-0:0.1.1-3.el6cf.src",
        "relates_to_product_reference": "6Server-SystemEngine"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Puppet Labs"
          ]
        }
      ],
      "cve": "CVE-2012-1986",
      "discovery_date": "2012-04-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "810069"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "puppet: Filebucket arbitrary file read",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-1986"
        },
        {
          "category": "external",
          "summary": "RHBZ#810069",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810069"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-1986",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-1986"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1986",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1986"
        },
        {
          "category": "external",
          "summary": "http://puppetlabs.com/security/cve/cve-2012-1986/",
          "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
        }
      ],
      "release_date": "2012-04-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "puppet: Filebucket arbitrary file read"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Puppet Labs"
          ]
        }
      ],
      "cve": "CVE-2012-1987",
      "discovery_date": "2012-04-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "810070"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "puppet: Filebucket denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-1987"
        },
        {
          "category": "external",
          "summary": "RHBZ#810070",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810070"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-1987",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-1987"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1987",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1987"
        },
        {
          "category": "external",
          "summary": "http://puppetlabs.com/security/cve/cve-2012-1987/",
          "url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
        }
      ],
      "release_date": "2012-04-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "puppet: Filebucket denial of service"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Puppet Labs"
          ]
        }
      ],
      "cve": "CVE-2012-1988",
      "discovery_date": "2012-04-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "810071"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "puppet: Filebucket arbitrary code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-1988"
        },
        {
          "category": "external",
          "summary": "RHBZ#810071",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=810071"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-1988",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-1988"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-1988",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-1988"
        },
        {
          "category": "external",
          "summary": "http://puppetlabs.com/security/cve/cve-2012-1988/",
          "url": "http://puppetlabs.com/security/cve/cve-2012-1988/"
        }
      ],
      "release_date": "2012-04-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "puppet: Filebucket arbitrary code execution"
    },
    {
      "cve": "CVE-2012-2139",
      "discovery_date": "2012-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "891762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-mail: directory traversal",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-2139"
        },
        {
          "category": "external",
          "summary": "RHBZ#891762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=891762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2139",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-2139"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2139",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2139"
        }
      ],
      "release_date": "2012-03-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "rubygem-mail: directory traversal"
    },
    {
      "cve": "CVE-2012-2140",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2012-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "816352"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-mail: arbitrary command execution when using exim or sendmail from commandline",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-2140"
        },
        {
          "category": "external",
          "summary": "RHBZ#816352",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2140",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-2140"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2140",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2140"
        }
      ],
      "release_date": "2012-03-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-mail: arbitrary command execution when using exim or sendmail from commandline"
    },
    {
      "cve": "CVE-2012-2660",
      "discovery_date": "2012-05-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "827353"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: Unsafe query generation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-2660"
        },
        {
          "category": "external",
          "summary": "RHBZ#827353",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2660",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-2660"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660"
        }
      ],
      "release_date": "2012-05-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "rubygem-actionpack: Unsafe query generation"
    },
    {
      "cve": "CVE-2012-2661",
      "discovery_date": "2012-05-31T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "827363"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-activerecord: SQL injection when processing nested query paramaters",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-2661"
        },
        {
          "category": "external",
          "summary": "RHBZ#827363",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2661",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-2661"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661"
        }
      ],
      "release_date": "2012-05-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "rubygem-activerecord: SQL injection when processing nested query paramaters"
    },
    {
      "cve": "CVE-2012-2694",
      "cwe": {
        "id": "CWE-305",
        "name": "Authentication Bypass by Primary Weakness"
      },
      "discovery_date": "2012-06-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "831581"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[\u0027xyz\u0027, nil]\" values, a related issue to CVE-2012-2660.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-2694"
        },
        {
          "category": "external",
          "summary": "RHBZ#831581",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2694",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-2694"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694"
        }
      ],
      "release_date": "2012-06-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)"
    },
    {
      "cve": "CVE-2012-2695",
      "cwe": {
        "id": "CWE-89",
        "name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
      },
      "discovery_date": "2012-06-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "831573"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-2695"
        },
        {
          "category": "external",
          "summary": "RHBZ#831573",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-2695",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-2695"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695"
        }
      ],
      "release_date": "2012-06-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)"
    },
    {
      "cve": "CVE-2012-3424",
      "discovery_date": "2012-07-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "843711"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3424"
        },
        {
          "category": "external",
          "summary": "RHBZ#843711",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3424",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3424"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424"
        }
      ],
      "release_date": "2012-07-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest"
    },
    {
      "cve": "CVE-2012-3463",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2012-08-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "847196"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3463"
        },
        {
          "category": "external",
          "summary": "RHBZ#847196",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3463",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3463"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463"
        }
      ],
      "release_date": "2012-08-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt"
    },
    {
      "cve": "CVE-2012-3464",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2012-08-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "847199"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a \u0027 (quote) character.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: potential XSS vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3464"
        },
        {
          "category": "external",
          "summary": "RHBZ#847199",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3464",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3464"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464"
        }
      ],
      "release_date": "2012-08-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: potential XSS vulnerability"
    },
    {
      "cve": "CVE-2012-3465",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2012-08-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "847200"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: XSS Vulnerability in strip_tags",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3465"
        },
        {
          "category": "external",
          "summary": "RHBZ#847200",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3465",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3465"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465"
        }
      ],
      "release_date": "2012-08-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: XSS Vulnerability in strip_tags"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Puppet Labs"
          ]
        }
      ],
      "cve": "CVE-2012-3864",
      "discovery_date": "2012-07-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "839130"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "puppet: authenticated clients allowed to read arbitrary files from the puppet master",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3864"
        },
        {
          "category": "external",
          "summary": "RHBZ#839130",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3864",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3864"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3864",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3864"
        },
        {
          "category": "external",
          "summary": "http://puppetlabs.com/security/cve/cve-2012-3864/",
          "url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
        }
      ],
      "release_date": "2012-07-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "puppet: authenticated clients allowed to read arbitrary files from the puppet master"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Puppet Labs"
          ]
        }
      ],
      "cve": "CVE-2012-3865",
      "discovery_date": "2012-07-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "839131"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "puppet: authenticated clients allowed to delete arbitrary files on the puppet master",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3865"
        },
        {
          "category": "external",
          "summary": "RHBZ#839131",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3865",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3865"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3865",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3865"
        },
        {
          "category": "external",
          "summary": "http://puppetlabs.com/security/cve/cve-2012-3865/",
          "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
        }
      ],
      "release_date": "2012-07-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 2.1,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "puppet: authenticated clients allowed to delete arbitrary files on the puppet master"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Puppet Labs"
          ]
        }
      ],
      "cve": "CVE-2012-3867",
      "discovery_date": "2012-07-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "839158"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "puppet: insufficient validation of agent names in CN of SSL certificate requests",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
          "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
          "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
          "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
          "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
          "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
          "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
          "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
          "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-3867"
        },
        {
          "category": "external",
          "summary": "RHBZ#839158",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-3867",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-3867"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3867",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3867"
        },
        {
          "category": "external",
          "summary": "http://puppetlabs.com/security/cve/cve-2012-3867/",
          "url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
        }
      ],
      "release_date": "2012-07-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-12-04T19:24:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
          "product_ids": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:1542"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-CloudEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-CloudEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-CloudEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-CloudEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-CloudEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.noarch",
            "6Server-SystemEngine:converge-ui-devel-0:1.0.4-1.el6cf.src",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:puppet-0:2.6.17-2.el6cf.src",
            "6Server-SystemEngine:puppet-server-0:2.6.17-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.noarch",
            "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-10.el6cf.src",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-6.el6cf.src",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.noarch",
            "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-4.el6cf.src",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-chunky_png-0:1.2.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-0:0.11.5-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-compass-960-plugin-0:0.10.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-compass-960-plugin-doc-0:0.10.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-2.el6cf.src",
            "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-2.el6cf.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.noarch",
            "6Server-SystemEngine:rubygem-ldap_fluff-0:0.1.3-1.el6_3.src",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-mail-0:2.3.0-3.el6cf.src",
            "6Server-SystemEngine:rubygem-mail-doc-0:2.3.0-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.noarch",
            "6Server-SystemEngine:rubygem-net-ldap-0:0.1.1-3.el6cf.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "puppet: insufficient validation of agent names in CN of SSL certificate requests"
    }
  ]
}

CVE-2012-3464 (GCVE-0-2012-3464)

Vulnerability from cvelistv5

Published

2012-08-10 10:00

Modified

2024-08-06 20:05

Severity ?

CWE

Summary

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

References

URL

Tags

	http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/	x_refsource_CONFIRM
	http://secunia.com/advisories/50694	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT
	https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source&output=gplain	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.658Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
          },
          {
            "name": "50694",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50694"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          },
          {
            "name": "[rubyonrails-security] 20120810 Potential XSS Vulnerability in Ruby on Rails",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source\u0026output=gplain"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-08-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a \u0027 (quote) character."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-02-07T10:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
        },
        {
          "name": "50694",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50694"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        },
        {
          "name": "[rubyonrails-security] 20120810 Potential XSS Vulnerability in Ruby on Rails",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source\u0026output=gplain"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-3464",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a \u0027 (quote) character."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/",
              "refsource": "CONFIRM",
              "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
            },
            {
              "name": "50694",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50694"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            },
            {
              "name": "[rubyonrails-security] 20120810 Potential XSS Vulnerability in Ruby on Rails",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source\u0026output=gplain"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3464",
    "datePublished": "2012-08-10T10:00:00",
    "dateReserved": "2012-06-14T00:00:00",
    "dateUpdated": "2024-08-06T20:05:12.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2139 (GCVE-0-2012-2139)

Vulnerability from cvelistv5

Published

2012-07-18 18:00

Modified

2024-08-06 19:26

Severity ?

CWE

Summary

Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.

References

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=816352	x_refsource_MISC
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html	vendor-advisory, x_refsource_FEDORA
	http://www.openwall.com/lists/oss-security/2012/04/25/8	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html	vendor-advisory, x_refsource_FEDORA
	https://bugzilla.novell.com/show_bug.cgi?id=759092	x_refsource_MISC
	http://secunia.com/advisories/48970	third-party-advisory, x_refsource_SECUNIA
	https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f	x_refsource_CONFIRM
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html	vendor-advisory, x_refsource_FEDORA
	http://www.openwall.com/lists/oss-security/2012/04/26/1	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:26:08.213Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
          },
          {
            "name": "FEDORA-2012-7535",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html"
          },
          {
            "name": "[oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/04/25/8"
          },
          {
            "name": "FEDORA-2012-7692",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.novell.com/show_bug.cgi?id=759092"
          },
          {
            "name": "48970",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48970"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f"
          },
          {
            "name": "FEDORA-2012-7619",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html"
          },
          {
            "name": "[oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/04/26/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-07-25T09:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
        },
        {
          "name": "FEDORA-2012-7535",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html"
        },
        {
          "name": "[oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/04/25/8"
        },
        {
          "name": "FEDORA-2012-7692",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.novell.com/show_bug.cgi?id=759092"
        },
        {
          "name": "48970",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48970"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f"
        },
        {
          "name": "FEDORA-2012-7619",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html"
        },
        {
          "name": "[oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/04/26/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-2139",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=816352",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
            },
            {
              "name": "FEDORA-2012-7535",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html"
            },
            {
              "name": "[oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/04/25/8"
            },
            {
              "name": "FEDORA-2012-7692",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html"
            },
            {
              "name": "https://bugzilla.novell.com/show_bug.cgi?id=759092",
              "refsource": "MISC",
              "url": "https://bugzilla.novell.com/show_bug.cgi?id=759092"
            },
            {
              "name": "48970",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48970"
            },
            {
              "name": "https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f",
              "refsource": "CONFIRM",
              "url": "https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f"
            },
            {
              "name": "FEDORA-2012-7619",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html"
            },
            {
              "name": "[oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/04/26/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2139",
    "datePublished": "2012-07-18T18:00:00",
    "dateReserved": "2012-04-04T00:00:00",
    "dateUpdated": "2024-08-06T19:26:08.213Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2140 (GCVE-0-2012-2140)

Vulnerability from cvelistv5

Published

2012-07-18 18:00

Modified

2024-08-06 19:26

Severity ?

CWE

Summary

The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.

References

URL

Tags

	https://bugzilla.redhat.com/show_bug.cgi?id=816352	x_refsource_MISC
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html	vendor-advisory, x_refsource_FEDORA
	https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2012/04/25/8	mailing-list, x_refsource_MLIST
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html	vendor-advisory, x_refsource_FEDORA
	https://bugzilla.novell.com/show_bug.cgi?id=759092	x_refsource_MISC
	http://secunia.com/advisories/48970	third-party-advisory, x_refsource_SECUNIA
	https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0	x_refsource_CONFIRM
	https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc	x_refsource_CONFIRM
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html	vendor-advisory, x_refsource_FEDORA
	http://www.openwall.com/lists/oss-security/2012/04/26/1	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:26:08.465Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
          },
          {
            "name": "FEDORA-2012-7535",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2"
          },
          {
            "name": "[oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/04/25/8"
          },
          {
            "name": "FEDORA-2012-7692",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.novell.com/show_bug.cgi?id=759092"
          },
          {
            "name": "48970",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48970"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc"
          },
          {
            "name": "FEDORA-2012-7619",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html"
          },
          {
            "name": "[oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/04/26/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-03-05T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-07-25T09:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
        },
        {
          "name": "FEDORA-2012-7535",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2"
        },
        {
          "name": "[oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/04/25/8"
        },
        {
          "name": "FEDORA-2012-7692",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.novell.com/show_bug.cgi?id=759092"
        },
        {
          "name": "48970",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48970"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc"
        },
        {
          "name": "FEDORA-2012-7619",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html"
        },
        {
          "name": "[oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/04/26/1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-2140",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=816352",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=816352"
            },
            {
              "name": "FEDORA-2012-7535",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080648.html"
            },
            {
              "name": "https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2",
              "refsource": "CONFIRM",
              "url": "https://github.com/mikel/mail/commit/ac56f03bdfc30b379aeecd4ff317d08fdaa328c2"
            },
            {
              "name": "[oss-security] 20120425 CVE request: two flaws fixed in rubygem-mail 2.4.4",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/04/25/8"
            },
            {
              "name": "FEDORA-2012-7692",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080645.html"
            },
            {
              "name": "https://bugzilla.novell.com/show_bug.cgi?id=759092",
              "refsource": "MISC",
              "url": "https://bugzilla.novell.com/show_bug.cgi?id=759092"
            },
            {
              "name": "48970",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48970"
            },
            {
              "name": "https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0",
              "refsource": "CONFIRM",
              "url": "https://github.com/mikel/mail/commit/39b590ddb08f90ddbe445837359a2c8843e533d0"
            },
            {
              "name": "https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc",
              "refsource": "CONFIRM",
              "url": "https://github.com/mikel/mail/blob/9beb079c70d236a5ad2e1ba95b2c977e55deb7af/CHANGELOG.rdoc"
            },
            {
              "name": "FEDORA-2012-7619",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080747.html"
            },
            {
              "name": "[oss-security] 20120425 Re: CVE request: two flaws fixed in rubygem-mail 2.4.4",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/04/26/1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2140",
    "datePublished": "2012-07-18T18:00:00",
    "dateReserved": "2012-04-04T00:00:00",
    "dateUpdated": "2024-08-06T19:26:08.465Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-3865 (GCVE-0-2012-3865)

Vulnerability from cvelistv5

Published

2012-08-06 16:00

Modified

2024-08-06 20:21

Severity ?

CWE

Summary

Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html	vendor-advisory, x_refsource_SUSE
	https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f	x_refsource_CONFIRM
	http://www.debian.org/security/2012/dsa-2511	vendor-advisory, x_refsource_DEBIAN
	http://www.ubuntu.com/usn/USN-1506-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/50014	third-party-advisory, x_refsource_SECUNIA
	http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	vendor-advisory, x_refsource_SUSE
	https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=839131	x_refsource_CONFIRM
	http://puppetlabs.com/security/cve/cve-2012-3865/	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:21:04.052Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2012:0983",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
          },
          {
            "name": "DSA-2511",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2511"
          },
          {
            "name": "USN-1506-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1506-1"
          },
          {
            "name": "50014",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50014"
          },
          {
            "name": "openSUSE-SU-2012:0891",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-07-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-08T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "SUSE-SU-2012:0983",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
        },
        {
          "name": "DSA-2511",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2511"
        },
        {
          "name": "USN-1506-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1506-1"
        },
        {
          "name": "50014",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50014"
        },
        {
          "name": "openSUSE-SU-2012:0891",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-3865",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2012:0983",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
            },
            {
              "name": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f",
              "refsource": "CONFIRM",
              "url": "https://github.com/puppetlabs/puppet/commit/554eefc55f57ed2b76e5ee04d8f194d36f6ee67f"
            },
            {
              "name": "DSA-2511",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2511"
            },
            {
              "name": "USN-1506-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1506-1"
            },
            {
              "name": "50014",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50014"
            },
            {
              "name": "openSUSE-SU-2012:0891",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
            },
            {
              "name": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6",
              "refsource": "CONFIRM",
              "url": "https://github.com/puppetlabs/puppet/commit/d80478208d79a3e6d6cb1fbc525e24817fe8c4c6"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=839131",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839131"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-3865/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-3865/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-3865",
    "datePublished": "2012-08-06T16:00:00",
    "dateReserved": "2012-07-06T00:00:00",
    "dateUpdated": "2024-08-06T20:21:04.052Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2694 (GCVE-0-2012-2694)

Vulnerability from cvelistv5

Published

2012-06-22 14:00

Modified

2024-08-06 19:42

Severity ?

CWE

Summary

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html	vendor-advisory, x_refsource_SUSE
	https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source&output=gplain	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:42:31.516Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2012:1015",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"
          },
          {
            "name": "SUSE-SU-2012:1012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
          },
          {
            "name": "openSUSE-SU-2012:0978",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
          },
          {
            "name": "SUSE-SU-2012:1014",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2012:1066",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
          },
          {
            "name": "[rubyonrails-security] 20120612 Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source\u0026output=gplain"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-06-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[\u0027xyz\u0027, nil]\" values, a related issue to CVE-2012-2660."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-09-07T09:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SUSE-SU-2012:1015",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"
        },
        {
          "name": "SUSE-SU-2012:1012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
        },
        {
          "name": "openSUSE-SU-2012:0978",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
        },
        {
          "name": "SUSE-SU-2012:1014",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2012:1066",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
        },
        {
          "name": "[rubyonrails-security] 20120612 Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source\u0026output=gplain"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-2694",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[\u0027xyz\u0027, nil]\" values, a related issue to CVE-2012-2660."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2012:1015",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"
            },
            {
              "name": "SUSE-SU-2012:1012",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
            },
            {
              "name": "openSUSE-SU-2012:0978",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
            },
            {
              "name": "SUSE-SU-2012:1014",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2012:1066",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
            },
            {
              "name": "[rubyonrails-security] 20120612 Ruby on Rails Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2694)",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/e2d3a87f2c211def?dmode=source\u0026output=gplain"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2694",
    "datePublished": "2012-06-22T14:00:00",
    "dateReserved": "2012-05-14T00:00:00",
    "dateUpdated": "2024-08-06T19:42:31.516Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-3463 (GCVE-0-2012-3463)

Vulnerability from cvelistv5

Published

2012-08-10 10:00

Modified

2024-08-06 20:05

Severity ?

CWE

Summary

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.

References

URL

Tags

	http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/	x_refsource_CONFIRM
	https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source&output=gplain	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.614Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
          },
          {
            "name": "[rubyonrails-security] 20120810 Ruby on Rails Potential XSS Vulnerability in select_tag prompt",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source\u0026output=gplain"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-08-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-02-07T10:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
        },
        {
          "name": "[rubyonrails-security] 20120810 Ruby on Rails Potential XSS Vulnerability in select_tag prompt",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source\u0026output=gplain"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-3463",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/",
              "refsource": "CONFIRM",
              "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
            },
            {
              "name": "[rubyonrails-security] 20120810 Ruby on Rails Potential XSS Vulnerability in select_tag prompt",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/961e18e514527078?dmode=source\u0026output=gplain"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3463",
    "datePublished": "2012-08-10T10:00:00",
    "dateReserved": "2012-06-14T00:00:00",
    "dateUpdated": "2024-08-06T20:05:12.614Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2695 (GCVE-0-2012-2695)

Vulnerability from cvelistv5

Published

2012-06-22 14:00

Modified

2024-08-06 19:42

Severity ?

CWE

Summary

The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html	vendor-advisory, x_refsource_SUSE
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT
	https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source&output=gplain	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:42:31.701Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2012:1012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
          },
          {
            "name": "openSUSE-SU-2012:0978",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
          },
          {
            "name": "SUSE-SU-2012:1014",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2012:1066",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          },
          {
            "name": "[rubyonrails-security] 20120612 Ruby on Rails SQL Injection (CVE-2012-2695)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source\u0026output=gplain"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-06-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-09-07T09:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SUSE-SU-2012:1012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
        },
        {
          "name": "openSUSE-SU-2012:0978",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
        },
        {
          "name": "SUSE-SU-2012:1014",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2012:1066",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        },
        {
          "name": "[rubyonrails-security] 20120612 Ruby on Rails SQL Injection (CVE-2012-2695)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source\u0026output=gplain"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-2695",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2012:1012",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
            },
            {
              "name": "openSUSE-SU-2012:0978",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
            },
            {
              "name": "SUSE-SU-2012:1014",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2012:1066",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            },
            {
              "name": "[rubyonrails-security] 20120612 Ruby on Rails SQL Injection (CVE-2012-2695)",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/aee3413fb038bf56?dmode=source\u0026output=gplain"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2695",
    "datePublished": "2012-06-22T14:00:00",
    "dateReserved": "2012-05-14T00:00:00",
    "dateUpdated": "2024-08-06T19:42:31.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2660 (GCVE-0-2012-2660)

Vulnerability from cvelistv5

Published

2012-06-22 14:00

Modified

2024-08-06 19:42

Severity ?

CWE

Summary

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2694.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html	vendor-advisory, x_refsource_SUSE
	https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain	mailing-list, x_refsource_MLIST
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:42:31.885Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2012:1015",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"
          },
          {
            "name": "SUSE-SU-2012:1012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
          },
          {
            "name": "openSUSE-SU-2012:0978",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
          },
          {
            "name": "SUSE-SU-2012:1014",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2012:1066",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
          },
          {
            "name": "[rubyonrails-security] 20120531 Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source\u0026output=gplain"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-05-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-09-07T09:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "SUSE-SU-2012:1015",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"
        },
        {
          "name": "SUSE-SU-2012:1012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
        },
        {
          "name": "openSUSE-SU-2012:0978",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
        },
        {
          "name": "SUSE-SU-2012:1014",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2012:1066",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
        },
        {
          "name": "[rubyonrails-security] 20120531 Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source\u0026output=gplain"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-2660",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2012:1015",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html"
            },
            {
              "name": "SUSE-SU-2012:1012",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
            },
            {
              "name": "openSUSE-SU-2012:0978",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html"
            },
            {
              "name": "SUSE-SU-2012:1014",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2012:1066",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
            },
            {
              "name": "[rubyonrails-security] 20120531 Unsafe Query Generation Risk in Ruby on Rails (CVE-2012-2660)",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source\u0026output=gplain"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2660",
    "datePublished": "2012-06-22T14:00:00",
    "dateReserved": "2012-05-14T00:00:00",
    "dateUpdated": "2024-08-06T19:42:31.885Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1987 (GCVE-0-2012-1987)

Vulnerability from cvelistv5

Published

2012-05-29 20:00

Modified

2024-08-06 19:17

Severity ?

CWE

Summary

Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.

References

URL

Tags

	https://exchange.xforce.ibmcloud.com/vulnerabilities/74794	vdb-entry, x_refsource_XF
	http://puppetlabs.com/security/cve/cve-2012-1987/	x_refsource_CONFIRM
	http://projects.puppetlabs.com/issues/13552	x_refsource_MISC
	http://ubuntu.com/usn/usn-1419-1	vendor-advisory, x_refsource_UBUNTU
	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html	vendor-advisory, x_refsource_FEDORA
	https://hermes.opensuse.org/messages/14523305	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/48743	third-party-advisory, x_refsource_SECUNIA
	http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/	x_refsource_CONFIRM
	http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15	x_refsource_CONFIRM
	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/49136	third-party-advisory, x_refsource_SECUNIA
	http://www.osvdb.org/81308	vdb-entry, x_refsource_OSVDB
	http://www.securityfocus.com/bid/52975	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/48748	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2012/dsa-2451	vendor-advisory, x_refsource_DEBIAN
	http://projects.puppetlabs.com/issues/13553	x_refsource_MISC
	https://hermes.opensuse.org/messages/15087408	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/48789	third-party-advisory, x_refsource_SECUNIA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.604Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "puppet-rest-dos(74795)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13552"
          },
          {
            "name": "USN-1419-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1419-1"
          },
          {
            "name": "FEDORA-2012-5999",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
          },
          {
            "name": "openSUSE-SU-2012:0608",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/14523305"
          },
          {
            "name": "48743",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48743"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
          },
          {
            "name": "FEDORA-2012-6055",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
          },
          {
            "name": "FEDORA-2012-6674",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
          },
          {
            "name": "49136",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49136"
          },
          {
            "name": "81308",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/81308"
          },
          {
            "name": "52975",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52975"
          },
          {
            "name": "48748",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48748"
          },
          {
            "name": "DSA-2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2451"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13553"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          },
          {
            "name": "48789",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "puppet-rest-dos(74795)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13552"
        },
        {
          "name": "USN-1419-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1419-1"
        },
        {
          "name": "FEDORA-2012-5999",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
        },
        {
          "name": "openSUSE-SU-2012:0608",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/14523305"
        },
        {
          "name": "48743",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48743"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
        },
        {
          "name": "FEDORA-2012-6055",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
        },
        {
          "name": "FEDORA-2012-6674",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
        },
        {
          "name": "49136",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49136"
        },
        {
          "name": "81308",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/81308"
        },
        {
          "name": "52975",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52975"
        },
        {
          "name": "48748",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48748"
        },
        {
          "name": "DSA-2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2451"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13553"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        },
        {
          "name": "48789",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48789"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1987",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use \"a marshaled form of a Puppet::FileBucket::File object\" to write to arbitrary file locations."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "puppet-rest-dos(74795)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1987/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1987/"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/13552",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13552"
            },
            {
              "name": "USN-1419-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1419-1"
            },
            {
              "name": "FEDORA-2012-5999",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
            },
            {
              "name": "openSUSE-SU-2012:0608",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/14523305"
            },
            {
              "name": "48743",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48743"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1987/hotfixes/"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
            },
            {
              "name": "FEDORA-2012-6055",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
            },
            {
              "name": "FEDORA-2012-6674",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
            },
            {
              "name": "49136",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49136"
            },
            {
              "name": "81308",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/81308"
            },
            {
              "name": "52975",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52975"
            },
            {
              "name": "48748",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48748"
            },
            {
              "name": "DSA-2451",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2451"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/13553",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13553"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            },
            {
              "name": "48789",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48789"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1987",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-04-02T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.604Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1988 (GCVE-0-2012-1988)

Vulnerability from cvelistv5

Published

2012-05-29 20:00

Modified

2024-08-06 19:17

Severity ?

CWE

Summary

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.

References

URL

Tags

	http://www.osvdb.org/81309	vdb-entry, x_refsource_OSVDB
	http://ubuntu.com/usn/usn-1419-1	vendor-advisory, x_refsource_UBUNTU
	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html	vendor-advisory, x_refsource_FEDORA
	http://puppetlabs.com/security/cve/cve-2012-1988/	x_refsource_CONFIRM
	http://projects.puppetlabs.com/issues/13518	x_refsource_MISC
	https://hermes.opensuse.org/messages/14523305	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/48743	third-party-advisory, x_refsource_SECUNIA
	http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/74796	vdb-entry, x_refsource_XF
	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/49136	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/52975	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/48748	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2012/dsa-2451	vendor-advisory, x_refsource_DEBIAN
	https://hermes.opensuse.org/messages/15087408	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/48789	third-party-advisory, x_refsource_SECUNIA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.716Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "81309",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/81309"
          },
          {
            "name": "USN-1419-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1419-1"
          },
          {
            "name": "FEDORA-2012-5999",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1988/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13518"
          },
          {
            "name": "openSUSE-SU-2012:0608",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/14523305"
          },
          {
            "name": "48743",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48743"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
          },
          {
            "name": "puppet-file-bucket-command-exec(74796)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74796"
          },
          {
            "name": "FEDORA-2012-6055",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
          },
          {
            "name": "FEDORA-2012-6674",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
          },
          {
            "name": "49136",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49136"
          },
          {
            "name": "52975",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52975"
          },
          {
            "name": "48748",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48748"
          },
          {
            "name": "DSA-2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2451"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          },
          {
            "name": "48789",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "81309",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/81309"
        },
        {
          "name": "USN-1419-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1419-1"
        },
        {
          "name": "FEDORA-2012-5999",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1988/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13518"
        },
        {
          "name": "openSUSE-SU-2012:0608",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/14523305"
        },
        {
          "name": "48743",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48743"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
        },
        {
          "name": "puppet-file-bucket-command-exec(74796)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74796"
        },
        {
          "name": "FEDORA-2012-6055",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
        },
        {
          "name": "FEDORA-2012-6674",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
        },
        {
          "name": "49136",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49136"
        },
        {
          "name": "52975",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52975"
        },
        {
          "name": "48748",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48748"
        },
        {
          "name": "DSA-2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2451"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        },
        {
          "name": "48789",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48789"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1988",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "81309",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/81309"
            },
            {
              "name": "USN-1419-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1419-1"
            },
            {
              "name": "FEDORA-2012-5999",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1988/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1988/"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/13518",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13518"
            },
            {
              "name": "openSUSE-SU-2012:0608",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/14523305"
            },
            {
              "name": "48743",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48743"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
            },
            {
              "name": "puppet-file-bucket-command-exec(74796)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74796"
            },
            {
              "name": "FEDORA-2012-6055",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
            },
            {
              "name": "FEDORA-2012-6674",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
            },
            {
              "name": "49136",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49136"
            },
            {
              "name": "52975",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52975"
            },
            {
              "name": "48748",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48748"
            },
            {
              "name": "DSA-2451",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2451"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            },
            {
              "name": "48789",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48789"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1988",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-04-02T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-3867 (GCVE-0-2012-3867)

Vulnerability from cvelistv5

Published

2012-08-06 16:00

Modified

2024-08-06 20:21

Severity ?

CWE

Summary

lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html	vendor-advisory, x_refsource_SUSE
	http://www.debian.org/security/2012/dsa-2511	vendor-advisory, x_refsource_DEBIAN
	http://www.ubuntu.com/usn/USN-1506-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/50014	third-party-advisory, x_refsource_SECUNIA
	http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	vendor-advisory, x_refsource_SUSE
	http://puppetlabs.com/security/cve/cve-2012-3867/	x_refsource_CONFIRM
	https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640	x_refsource_CONFIRM
	https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=839158	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:21:04.014Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2012:0983",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
          },
          {
            "name": "DSA-2511",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2511"
          },
          {
            "name": "USN-1506-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1506-1"
          },
          {
            "name": "50014",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50014"
          },
          {
            "name": "openSUSE-SU-2012:0891",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-07-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-08T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "SUSE-SU-2012:0983",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
        },
        {
          "name": "DSA-2511",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2511"
        },
        {
          "name": "USN-1506-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1506-1"
        },
        {
          "name": "50014",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50014"
        },
        {
          "name": "openSUSE-SU-2012:0891",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-3867",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2012:0983",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
            },
            {
              "name": "DSA-2511",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2511"
            },
            {
              "name": "USN-1506-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1506-1"
            },
            {
              "name": "50014",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50014"
            },
            {
              "name": "openSUSE-SU-2012:0891",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-3867/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-3867/"
            },
            {
              "name": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640",
              "refsource": "CONFIRM",
              "url": "https://github.com/puppetlabs/puppet/commit/dfedaa5fa841ccf335245a748b347b7c7c236640"
            },
            {
              "name": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50",
              "refsource": "CONFIRM",
              "url": "https://github.com/puppetlabs/puppet/commit/f3419620b42080dad3b0be14470b20a972f13c50"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=839158",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839158"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-3867",
    "datePublished": "2012-08-06T16:00:00",
    "dateReserved": "2012-07-06T00:00:00",
    "dateUpdated": "2024-08-06T20:21:04.014Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-1986 (GCVE-0-2012-1986)

Vulnerability from cvelistv5

Published

2012-05-29 20:00

Modified

2024-08-06 19:17

Severity ?

CWE

Summary

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.

References

URL

Tags

	http://ubuntu.com/usn/usn-1419-1	vendor-advisory, x_refsource_UBUNTU
	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html	vendor-advisory, x_refsource_FEDORA
	http://puppetlabs.com/security/cve/cve-2012-1986/	x_refsource_CONFIRM
	https://hermes.opensuse.org/messages/14523305	vendor-advisory, x_refsource_SUSE
	https://exchange.xforce.ibmcloud.com/vulnerabilities/74794	vdb-entry, x_refsource_XF
	http://secunia.com/advisories/48743	third-party-advisory, x_refsource_SECUNIA
	http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15	x_refsource_CONFIRM
	http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html	vendor-advisory, x_refsource_FEDORA
	http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html	vendor-advisory, x_refsource_FEDORA
	http://projects.puppetlabs.com/issues/13511	x_refsource_MISC
	http://secunia.com/advisories/49136	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/52975	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/48748	third-party-advisory, x_refsource_SECUNIA
	http://www.debian.org/security/2012/dsa-2451	vendor-advisory, x_refsource_DEBIAN
	https://hermes.opensuse.org/messages/15087408	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/48789	third-party-advisory, x_refsource_SECUNIA

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:17:27.701Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "USN-1419-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-1419-1"
          },
          {
            "name": "FEDORA-2012-5999",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
          },
          {
            "name": "openSUSE-SU-2012:0608",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/14523305"
          },
          {
            "name": "puppet-rest-symlink(74794)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
          },
          {
            "name": "48743",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48743"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
          },
          {
            "name": "FEDORA-2012-6055",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
          },
          {
            "name": "FEDORA-2012-6674",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://projects.puppetlabs.com/issues/13511"
          },
          {
            "name": "49136",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/49136"
          },
          {
            "name": "52975",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/52975"
          },
          {
            "name": "48748",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48748"
          },
          {
            "name": "DSA-2451",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2451"
          },
          {
            "name": "openSUSE-SU-2012:0835",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15087408"
          },
          {
            "name": "48789",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/48789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-04-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "USN-1419-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-1419-1"
        },
        {
          "name": "FEDORA-2012-5999",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
        },
        {
          "name": "openSUSE-SU-2012:0608",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/14523305"
        },
        {
          "name": "puppet-rest-symlink(74794)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
        },
        {
          "name": "48743",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48743"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
        },
        {
          "name": "FEDORA-2012-6055",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
        },
        {
          "name": "FEDORA-2012-6674",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://projects.puppetlabs.com/issues/13511"
        },
        {
          "name": "49136",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/49136"
        },
        {
          "name": "52975",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/52975"
        },
        {
          "name": "48748",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48748"
        },
        {
          "name": "DSA-2451",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2451"
        },
        {
          "name": "openSUSE-SU-2012:0835",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15087408"
        },
        {
          "name": "48789",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/48789"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1986",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "USN-1419-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-1419-1"
            },
            {
              "name": "FEDORA-2012-5999",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079227.html"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-1986/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-1986/"
            },
            {
              "name": "openSUSE-SU-2012:0608",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/14523305"
            },
            {
              "name": "puppet-rest-symlink(74794)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74794"
            },
            {
              "name": "48743",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48743"
            },
            {
              "name": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15",
              "refsource": "CONFIRM",
              "url": "http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.15"
            },
            {
              "name": "FEDORA-2012-6055",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079289.html"
            },
            {
              "name": "FEDORA-2012-6674",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080003.html"
            },
            {
              "name": "http://projects.puppetlabs.com/issues/13511",
              "refsource": "MISC",
              "url": "http://projects.puppetlabs.com/issues/13511"
            },
            {
              "name": "49136",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/49136"
            },
            {
              "name": "52975",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/52975"
            },
            {
              "name": "48748",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48748"
            },
            {
              "name": "DSA-2451",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2451"
            },
            {
              "name": "openSUSE-SU-2012:0835",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15087408"
            },
            {
              "name": "48789",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/48789"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1986",
    "datePublished": "2012-05-29T20:00:00",
    "dateReserved": "2012-04-02T00:00:00",
    "dateUpdated": "2024-08-06T19:17:27.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-3465 (GCVE-0-2012-3465)

Vulnerability from cvelistv5

Published

2012-08-10 10:00

Modified

2024-08-06 20:05

Severity ?

CWE

Summary

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.

References

URL

Tags

	http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/	x_refsource_CONFIRM
	http://secunia.com/advisories/50694	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT
	https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source&output=gplain	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.646Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
          },
          {
            "name": "50694",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50694"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          },
          {
            "name": "[rubyonrails-security] 20120810 XSS Vulnerability in strip_tags",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source\u0026output=gplain"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-08-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2013-02-07T10:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
        },
        {
          "name": "50694",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50694"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        },
        {
          "name": "[rubyonrails-security] 20120810 XSS Vulnerability in strip_tags",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source\u0026output=gplain"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-3465",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/",
              "refsource": "CONFIRM",
              "url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/"
            },
            {
              "name": "50694",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50694"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            },
            {
              "name": "[rubyonrails-security] 20120810 XSS Vulnerability in strip_tags",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/7fbb5392d4d282b5?dmode=source\u0026output=gplain"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3465",
    "datePublished": "2012-08-10T10:00:00",
    "dateReserved": "2012-06-14T00:00:00",
    "dateUpdated": "2024-08-06T20:05:12.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-3424 (GCVE-0-2012-3424)

Vulnerability from cvelistv5

Published

2012-08-08 10:00

Modified

2024-08-06 20:05

Severity ?

CWE

Summary

The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.

References

URL

Tags

	https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en&dmode=source&output=gplain	mailing-list, x_refsource_MLIST
	http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html	vendor-advisory, x_refsource_SUSE
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.401Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[rubyonrails-security] 20120726 Ruby on Rails DoS Vulnerability in authenticate_or_request_with_http_digest (CVE-2012-3424)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en\u0026dmode=source\u0026output=gplain"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/"
          },
          {
            "name": "openSUSE-SU-2012:1066",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-07-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-11-06T10:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[rubyonrails-security] 20120726 Ruby on Rails DoS Vulnerability in authenticate_or_request_with_http_digest (CVE-2012-3424)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en\u0026dmode=source\u0026output=gplain"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/"
        },
        {
          "name": "openSUSE-SU-2012:1066",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-3424",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[rubyonrails-security] 20120726 Ruby on Rails DoS Vulnerability in authenticate_or_request_with_http_digest (CVE-2012-3424)",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/244d32f2fa25147d?hl=en\u0026dmode=source\u0026output=gplain"
            },
            {
              "name": "http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/",
              "refsource": "CONFIRM",
              "url": "http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/"
            },
            {
              "name": "openSUSE-SU-2012:1066",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3424",
    "datePublished": "2012-08-08T10:00:00",
    "dateReserved": "2012-06-14T00:00:00",
    "dateUpdated": "2024-08-06T20:05:12.401Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-2661 (GCVE-0-2012-2661)

Vulnerability from cvelistv5

Published

2012-06-22 14:00

Modified

2024-08-06 19:42

Severity ?

CWE

Summary

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.

References

URL

Tags

	https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html	vendor-advisory, x_refsource_SUSE
	http://rhn.redhat.com/errata/RHSA-2013-0154.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T19:42:31.596Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[rubyonrails-security] 20120531 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-2661)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source\u0026output=gplain"
          },
          {
            "name": "SUSE-SU-2012:1012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
          },
          {
            "name": "SUSE-SU-2012:1014",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
          },
          {
            "name": "openSUSE-SU-2012:1066",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
          },
          {
            "name": "RHSA-2013:0154",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-05-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-11-06T10:00:00",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "[rubyonrails-security] 20120531 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-2661)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source\u0026output=gplain"
        },
        {
          "name": "SUSE-SU-2012:1012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
        },
        {
          "name": "SUSE-SU-2012:1014",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
        },
        {
          "name": "openSUSE-SU-2012:1066",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
        },
        {
          "name": "RHSA-2013:0154",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-2661",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[rubyonrails-security] 20120531 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-2661)",
              "refsource": "MLIST",
              "url": "https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source\u0026output=gplain"
            },
            {
              "name": "SUSE-SU-2012:1012",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html"
            },
            {
              "name": "SUSE-SU-2012:1014",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html"
            },
            {
              "name": "openSUSE-SU-2012:1066",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html"
            },
            {
              "name": "RHSA-2013:0154",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-2661",
    "datePublished": "2012-06-22T14:00:00",
    "dateReserved": "2012-05-14T00:00:00",
    "dateUpdated": "2024-08-06T19:42:31.596Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-3864 (GCVE-0-2012-3864)

Vulnerability from cvelistv5

Published

2012-08-06 16:00

Modified

2024-08-06 20:21

Severity ?

CWE

Summary

Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.

References

URL

Tags

	http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html	vendor-advisory, x_refsource_SUSE
	http://puppetlabs.com/security/cve/cve-2012-3864/	x_refsource_CONFIRM
	http://www.debian.org/security/2012/dsa-2511	vendor-advisory, x_refsource_DEBIAN
	http://www.ubuntu.com/usn/USN-1506-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/50014	third-party-advisory, x_refsource_SECUNIA
	https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html	vendor-advisory, x_refsource_SUSE
	https://bugzilla.redhat.com/show_bug.cgi?id=839130	x_refsource_CONFIRM
	https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:21:04.064Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "SUSE-SU-2012:0983",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
          },
          {
            "name": "DSA-2511",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2012/dsa-2511"
          },
          {
            "name": "USN-1506-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1506-1"
          },
          {
            "name": "50014",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/50014"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
          },
          {
            "name": "openSUSE-SU-2012:0891",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-07-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2014-10-08T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "SUSE-SU-2012:0983",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
        },
        {
          "name": "DSA-2511",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2012/dsa-2511"
        },
        {
          "name": "USN-1506-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1506-1"
        },
        {
          "name": "50014",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/50014"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
        },
        {
          "name": "openSUSE-SU-2012:0891",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-3864",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user\u0027s certificate and private key in a GET request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "SUSE-SU-2012:0983",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00006.html"
            },
            {
              "name": "http://puppetlabs.com/security/cve/cve-2012-3864/",
              "refsource": "CONFIRM",
              "url": "http://puppetlabs.com/security/cve/cve-2012-3864/"
            },
            {
              "name": "DSA-2511",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2012/dsa-2511"
            },
            {
              "name": "USN-1506-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1506-1"
            },
            {
              "name": "50014",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/50014"
            },
            {
              "name": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4",
              "refsource": "CONFIRM",
              "url": "https://github.com/puppetlabs/puppet/commit/10f6cb8969b4d5a933b333ecb01ce3696b1d57d4"
            },
            {
              "name": "openSUSE-SU-2012:0891",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-updates/2012-07/msg00036.html"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=839130",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=839130"
            },
            {
              "name": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87",
              "refsource": "CONFIRM",
              "url": "https://github.com/puppetlabs/puppet/commit/c3c7462e4066bf3a563987a402bf3ddf278bcd87"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-3864",
    "datePublished": "2012-08-06T16:00:00",
    "dateReserved": "2012-07-06T00:00:00",
    "dateUpdated": "2024-08-06T20:21:04.064Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

RHSA-2012:1542

Vulnerability from csaf_redhat

CVE-2012-3464 (GCVE-0-2012-3464)

Vulnerability from cvelistv5

CVE-2012-2139 (GCVE-0-2012-2139)

Vulnerability from cvelistv5

CVE-2012-2140 (GCVE-0-2012-2140)

Vulnerability from cvelistv5

CVE-2012-3865 (GCVE-0-2012-3865)

Vulnerability from cvelistv5

CVE-2012-2694 (GCVE-0-2012-2694)

Vulnerability from cvelistv5

CVE-2012-3463 (GCVE-0-2012-3463)

Vulnerability from cvelistv5

CVE-2012-2695 (GCVE-0-2012-2695)

Vulnerability from cvelistv5

CVE-2012-2660 (GCVE-0-2012-2660)

Vulnerability from cvelistv5

CVE-2012-1987 (GCVE-0-2012-1987)

Vulnerability from cvelistv5

CVE-2012-1988 (GCVE-0-2012-1988)

Vulnerability from cvelistv5

CVE-2012-3867 (GCVE-0-2012-3867)

Vulnerability from cvelistv5

CVE-2012-1986 (GCVE-0-2012-1986)

Vulnerability from cvelistv5

CVE-2012-3465 (GCVE-0-2012-3465)

Vulnerability from cvelistv5

CVE-2012-3424 (GCVE-0-2012-3424)

Vulnerability from cvelistv5

CVE-2012-2661 (GCVE-0-2012-2661)

Vulnerability from cvelistv5

CVE-2012-3864 (GCVE-0-2012-3864)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature