CVE-2011-3872

https://notcve.org/view.php?id=CVE-2011-3872

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability." Puppet v2.6.x antes de v2.6.12 y v2.7.x antes de v2.7.6, y Puppet Enterprise (PE) Users v1.0, v1.1, y v1.2 antes de v1.2.4, al firmar un certificado de agente, añade los valores de Puppet master's certdnsnames al campo X.509 Subject Alternative Name, lo que permite a atacantes remotos falsificar un Puppet master a través de un ataque "Man-in-the-middle" contra un agente que utilice un nombre alternativo de DNS para el maestro, también conocido como "Vulnerabilidad AltNames." • http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1 http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability http://secunia.com/advisories/46550 http://secunia.com/advisories/46578 http://secunia.com/advisories/46934 http://secunia.com/advisories/46964 http://www.securityfocus.com/bid/50356 http://www.ubuntu.com/usn/USN-1238-1 http://www.ubuntu.com/usn/USN-1238-2 https://exchange.xforce.ibmcloud.com/vulnerabilities/70970 https:/&# • CWE-20: Improper Input Validation •