Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2012-1987

16
FAUCET Score

CVE-2012-1987 is an unspecified vulnerability affecting Puppet 2.6.x before 2.6.15, 2.7.x before 2.7.13, and various Puppet Enterprise versions before 2.5.1. This flaw allows remote authenticated users with agent SSL keys to cause denial-of-service conditions. Specifically, attackers can trigger memory exhaustion via REST requests to a streaming endpoint or achieve filesystem consumption by writing to arbitrary locations using crafted Puppet::FileBucket::File objects. The vulnerability has a CVSS score of 3.5, indicating a medium attack complexity and partial availability impact, but no confidentiality or integrity impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
>= 2.6.0, < 2.6.15CPE matchmatch criteria
cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*
>= 2.7.0, < 2.7.13CPE matchmatch criteria
cpe:2.3:a:puppet:puppet:*:*:*:*:*:*:*:*
>= 1.0, < 2.5.1CPE matchmatch criteria
cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

3.5LOW

AV:N/AC:M/Au:S/C:N/I:N/A:P

Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Exploitability Score
6.8
Impact Score
2.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
2.55%
Probability of exploitation in next 30 days
EPSS Percentile
83.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0255 is in the 93rd percentile among its peer group of 1,636 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (15)

redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-mail-0:2.3.0-3.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-net-ldap-0:0.1.1-3.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: converge-ui-devel-0:1.0.4-1.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: puppet-0:2.6.17-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-actionpack-1:3.0.10-10.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-activerecord-1:3.0.10-6.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-activesupport-1:3.0.10-4.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-chunky_png-0:1.2.0-3.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-compass-0:0.11.5-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-compass-960-plugin-0:0.10.4-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-delayed_job-0:2.1.4-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms for RHEL 6Fixed in: rubygem-ldap_fluff-0:0.1.3-1.el6_3
View patch
rubygemspatch availablevia ghsa
Product: puppetFixed in: 2.6.15
rubygemspatch availablevia ghsa
Product: puppetFixed in: 2.7.13
redhatend of lifevia redhat_api
Product: Red Hat Enterprise MRG 1Fixed in: puppet

Vendor Advisories (2)

rubygemsGHSA-v58w-6xc2-w799low

Puppet Denial of Service and Arbitrary File Write

May 14, 2022
redhatCVE-2012-1987Low

puppet: Filebucket denial of service

Apr 10, 2012

References

lists.fedoraproject.org / pipermail/package-announce/2012-April/079227.html
Broken Link
lists.fedoraproject.org / pipermail/package-announce/2012-April/079289.html
Broken Link
lists.fedoraproject.org / pipermail/package-announce/2012-May/080003.html
Broken Link
projects.puppetlabs.com / issues/13552
Broken LinkVendor Advisory
projects.puppetlabs.com / issues/13553
Broken LinkVendor Advisory
projects.puppetlabs.com / projects/1/wiki/Release_Notes
Broken Link
puppetlabs.com / security/cve/cve-2012-1987
Broken LinkVendor Advisory
puppetlabs.com / security/cve/cve-2012-1987/hotfixes
Broken LinkVendor Advisory
secunia.com / advisories/48743
Broken LinkVendor Advisory
secunia.com / advisories/48748
Broken LinkVendor Advisory
secunia.com / advisories/48789
Broken LinkVendor Advisory
secunia.com / advisories/49136
Broken LinkVendor Advisory
exchange.xforce.ibmcloud.com / vulnerabilities/74794
Third Party Advisory
hermes.opensuse.org / messages/14523305
Broken Link
hermes.opensuse.org / messages/15087408
Broken Link
ubuntu.com / usn/usn-1419-1
Third Party Advisory
debian.org / security/2012/dsa-2451
Mailing ListThird Party Advisory
osvdb.org / 81308
Broken Link
securityfocus.com / bid/52975
Broken Link