CVE-2011-3872

CVE-2011-3872 is a low-severity vulnerability in Puppet with a CVSS 2.0 base score of 2.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.

Key facts

• Severity: Low (CVSS 2.0 base score 2.6)
• EPSS exploit prediction: 2% (83rd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-20
• Affected product: Puppet
• Published: 2011-10-27
• Last modified: 2026-06-16

Description

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

Frequently asked questions

What is CVE-2011-3872?

Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."

How severe is CVE-2011-3872?

CVE-2011-3872 has a CVSS 2.0 base score of 2.6, rated low severity.

Is CVE-2011-3872 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (83rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2011-3872?

CVE-2011-3872 primarily affects Puppet. In total, 24 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2011-3872?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2011-3872 published?

CVE-2011-3872 was published on 2011-10-27 and last updated on 2026-06-16.

References

• http://groups.google.com/group/puppet-announce/browse_thread/thread/e7edc3a71348f3e1
• http://puppetlabs.com/blog/important-security-announcement-altnames-vulnerability/
• http://secunia.com/advisories/46550
• http://secunia.com/advisories/46578
• http://secunia.com/advisories/46934
• http://secunia.com/advisories/46964
• http://www.securityfocus.com/bid/50356
• http://www.ubuntu.com/usn/USN-1238-1
• http://www.ubuntu.com/usn/USN-1238-2
• https://exchange.xforce.ibmcloud.com/vulnerabilities/70970
• https://puppet.com/security/cve/cve-2011-3872

Affected products (24)

• cpe:2.3:a:puppet:puppet:2.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.2:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.3:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.4:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.5:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.6:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.7:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.8:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.9:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.10:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.6.11:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.3:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.4:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet:2.7.5:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.2:*:*:*:*:*:*:*
• cpe:2.3:a:puppet:puppet_enterprise:1.2.3:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.0:*:*:*:*:*:*:*
• cpe:2.3:a:puppetlabs:puppet_enterprise_users:1.1:*:*:*:*:*:*:*

More vulnerabilities in Puppet

• CVE-2016-2785 — Critical (CVSS 9.8): Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might…
• CVE-2013-1640 — Critical (CVSS 9.0): The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21,…
• CVE-2021-27021 — High (CVSS 8.8): A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete…
• CVE-2018-6513 — High (CVSS 8.8): Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x…
• CVE-2017-2295 — High (CVSS 8.2): Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with…
• CVE-2018-6515 — High (CVSS 7.8): Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on…

All CVEs affecting Puppet →

Other CWE-20 (Improper Input Validation) vulnerabilities

• CVE-2026-48056 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0…
• CVE-2026-33267 — Critical (CVSS 10.0): Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0…
• CVE-2026-47668 — Critical (CVSS 10.0): DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST…
• CVE-2026-16117 — Critical (CVSS 10.0): Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix…
• CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
• CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…

Browse all CWE-20 (Improper Input Validation) vulnerabilities →