Published: 19/08/2013 Updated: 10/07/2019

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Puppet 2.7.x prior to 2.7.22 and 3.2.x prior to 3.2.2, and Puppet Enterprise prior to 2.8.2, deserializes untrusted YAML, which allows remote malicious users to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppetlabs puppet 2.7.1
puppet puppet 2.7.10
puppet puppet 2.7.18
puppetlabs puppet 2.7.19
puppetlabs puppet 3.2.0
puppet puppet 2.7.13
puppet puppet 2.7.14
puppetlabs puppet 2.7.20
puppet puppet 2.7.21
puppet puppet 2.7.11
puppet puppet 2.7.12
puppet puppet 2.7.2
puppet puppet 3.2.1
puppetlabs puppet 2.7.0
puppet puppet 2.7.16
puppet puppet 2.7.17
canonical ubuntu linux 12.10
canonical ubuntu linux 12.04
canonical ubuntu linux 13.04
novell suse linux enterprise server 11.0
novell suse linux enterprise desktop 11.0
novell suse linux enterprise desktop 11
puppet puppet enterprise
puppet puppet enterprise 1.0
puppetlabs puppet 2.5.0
puppet puppet enterprise 2.5.1
puppet puppet enterprise 1.2.0
puppetlabs puppet 1.1.0
puppetlabs puppet 1.0.0
puppet puppet enterprise 1.1
puppet puppet enterprise 2.5.2
puppetlabs puppet 2.6.0
puppetlabs puppet 1.2.0
puppet puppet enterprise 2.0.0
puppetlabs puppet 2.7.2
puppet puppet enterprise 2.8.0

Debian Bug report logs - #712745 puppet: CVE-2013-3567 Package: puppet; Maintainer for puppet is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Source for puppet is src:puppet (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@inutilorg> Date: Wed, 19 Jun 2013 05:21:01 UTC Severity: ...

Puppet could be made to run programs if it received specially crafted network traffic ...

Synopsis Moderate: puppet security update Type/Severity Security Advisory: Moderate Topic Updated puppet packages that fix several security issues are now availablefor Red Hat OpenStack 30The Red Hat Security Response Team has rated this update as having moderatesecurity impact Common Vulnerability Scori ...

Synopsis Critical: ruby193-puppet security update Type/Severity Security Advisory: Critical Topic Updated ruby193-puppet packages that fix three security issues are nowavailable for Red Hat OpenStack 30The Red Hat Security Response Team has rated this update as having criticalsecurity impact Common Vulne ...

It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads A remote attacker could use a specially-crafted payload to execute arbitrary code on the puppet master For the oldstable distribution (squeeze), this problem will be fixed in version 262-5+squeeze8 For the stable distribution (w ...

Puppet 27x before 2722 and 32x before 322, and Puppet Enterprise before 282, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call ...

Remote code execution vuln appears in Puppet

The Register • Jack Clark in San Francisco • 18 Jun 2013

Big trouble in automated clouds

Puppet Labs has blasted out a security advisory about a vulnerability in the popular infrastructure management tool Puppet. The CVE-2013-3567 (Unauthenticated Remote Code Execution Vulnerability) warning was issued by Puppet Labs on Tuesday, and advises all Puppet users to upgrade to versions 2.7.22, 3.2.2 or later, and paid-for customers of Puppet Enterprise to move to 2.8.2. The vulnerability is serious as it allows for code to be executed remotely. "When making REST api calls, the puppet mast...

CVE-2013-3567

Vulnerability Summary

Vendor Advisories

Recent Articles

References

Vulmon Search

About

Products

Connect