A directory traversal vulnerability in puppet allowed
unauthenticated remote attackers to upload x.509
certificate signing requests to arbitrary locations
(CVE-2011-3848)