CVE-2012-3866: lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permiss...

Security readout for executives and security teams

This issue exposes Puppet run report data on affected Puppet master servers because a report file was created with overly broad read permissions. A local user on the server could read sensitive configuration information. The business urgency depends on whether legacy Puppet versions still run and whether untrusted users have local access. Exposure is likely limited to organizations still running old Puppet 2.7.x or Puppet Enterprise before 2.5.2, especially on multi-user Puppet master hosts. Modern deployments are unlikely exposed unless legacy systems remain in service or archived images are reused. Treat as a targeted legacy exposure check, not an emergency internet-wide incident. Prioritize quickly if Puppet masters contain secrets or allow local access by contractors, shared administrators, or application users. Mitigation focus: Upgrade Puppet to 2.7.18 or later where applicable.; Upgrade Puppet Enterprise to 2.5.2 or later where applicable.; Review vendor advisories for distribution-specific package fixes..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.