Published: 20/03/2013 Updated: 24/01/2022

CVSS v2 Base Score: 9 | Impact Score: 10 | Exploitability Score: 8

VMScore: 801

Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C

The (1) template and (2) inline_template functions in the master server in Puppet prior to 2.6.18, 2.7.x prior to 2.7.21, and 3.1.x prior to 3.1.1, and Puppet Enterprise prior to 1.2.7 and 2.7.x prior to 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppet puppet
puppet puppet 3.1.0
puppet puppet enterprise
puppet puppet enterprise 2.7.0
puppet puppet enterprise 2.7.1
canonical ubuntu linux 12.04
canonical ubuntu linux 11.10
canonical ubuntu linux 12.10

Synopsis Important: puppet security update Type/Severity Security Advisory: Important Topic Updated puppet packages that fix several security issues are now availablefor Red Hat OpenStack FolsomThe Red Hat Security Response Team has rated this update as havingimportant security impact Common Vulnerability ...

Several security issues were fixed in Puppet ...

Multiple vulnerabilities were discovered in Puppet, a centralized configuration management system CVE-2013-1640 An authenticated malicious client may request its catalog from the puppet master, and cause the puppet master to execute arbitrary code The puppet master must be made to invoke the template or inline_template functions ...

The (1) template and (2) inline_template functions in the master server in Puppet before 2618, 27x before 2721, and 31x before 311, and Puppet Enterprise before 127 and 27x before 272 allows remote authenticated users to execute arbitrary code via a crafted catalog request ...

NVD-CWE-noinfo http://www.debian.org/security/2013/dsa-2643 http://ubuntu.com/usn/usn-1759-1 https://puppetlabs.com/security/cve/cve-2013-1640/http://secunia.com/advisories/52596 http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html http://rhn.redhat.com/errata/RHSA-2013-0710.html https://access.redhat.com/errata/RHSA-2013:0710 https://usn.ubuntu.com/1759-1/https://nvd.nist.gov

CVE-2013-1640

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect