CVE-2012-3408

Name	CVE-2012-3408
Description	lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
puppet	source	(unstable)	2.7.18-1	low

Notes

[squeeze] - puppet <no-dsa> (Minor issue)
http://puppetlabs.com/security/cve/cve-2012-3408/
There's no code fix, but this should be addressed in stable with a NEWS file warning about this
Fixed in 2.7.18 by updated docs