CVE-2011-3872

CVE-2011-3872 is a low-severity vulnerability in Puppet with a CVSS 2.0 base score of 2.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

• Severity: Low (CVSS 2.0 base score 2.6)
• EPSS exploit prediction: 2% (82nd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-20
• Affected product: Puppet
• Published: 2011-10-27
• Last modified: 2026-06-16

Description

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

Frequently asked questions

What is CVE-2011-3872?

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

How severe is CVE-2011-3872?

CVE-2011-3872 has a CVSS 2.0 base score of 2.6, rated low severity.

Is CVE-2011-3872 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (82nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2011-3872?

CVE-2011-3872 primarily affects Puppet. In total, 24 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2011-3872?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2011-3872 published?

CVE-2011-3872 was published on 2011-10-27 and last updated on 2026-06-16.

References

• http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1
• http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/
• http://secunia.com/advisories/46550
• http://secunia.com/advisories/46578
• http://secunia.com/advisories/46934
• http://secunia.com/advisories/46964
• http://www.securityfocus.com/bid/50356
• http://www.ubuntu.com/usn/USN-1238-1
• http://www.ubuntu.com/usn/USN-1238-2
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70970
• https://puppet.com/security/cve/cve-2011-3872

Affected products (24)

• cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*

More vulnerabilities in Puppet

• CVE-2016-2785 — Critical (CVSS 9.8): Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might…
• CVE-2013-1640 — Critical (CVSS 9.0): The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21,…
• CVE-2021-27021 — High (CVSS 8.8): A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete…
• CVE-2018-6513 — High (CVSS 8.8): Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x…
• CVE-2017-2295 — High (CVSS 8.2): Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with…
• CVE-2018-6515 — High (CVSS 7.8): Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on…

All CVEs affecting Puppet →

Other CWE-20 (Improper Input Validation) vulnerabilities

• CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
• CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
• CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →