Published: 05/07/2017 Updated: 24/05/2018

CVSS v2 Base Score: 6 | Impact Score: 6.4 | Exploitability Score: 6.8

CVSS v3 Base Score: 8.2 | Impact Score: 5.8 | Exploitability Score: 1.8

VMScore: 534

Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P

Versions of Puppet before 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

Vulnerable Product	Search on Vulmon	Subscribe to Product
puppet puppet
debian debian linux 8.0

Synopsis Important: Satellite 63 security, bug fix, and enhancement update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat SatelliteRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...

Debian Bug report logs - #863212 puppet: CVE-2017-2295: unsafe YAML deserialization Package: src:puppet; Maintainer for src:puppet is Puppet Package Maintainers <pkg-puppet-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 23 May 2017 17:15:02 UTC Severity: grave Tags: p ...

Several security issues were fixed in Puppet ...

Unsafe YAML deserialization:Versions of Puppet prior to 4101 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution This change constrains the format of data on the wire to PSO ...

Versions of Puppet prior to 4101 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution This change constrains the format of data on the wire to PSON or safely decoded YAML ...

CWE-502 https://puppet.com/security/cve/cve-2017-2295 http://www.securityfocus.com/bid/98582 http://www.debian.org/security/2017/dsa-3862 https://access.redhat.com/errata/RHSA-2018:0336 https://usn.ubuntu.com/3308-1/https://nvd.nist.gov

CVE-2017-2295

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect