Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-1655US | high7.5 | — | ||
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.htmlWEB
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.htmlWEB
- http://ubuntu.com/usn/usn-1759-1WEB
- http://www.debian.org/security/2013/dsa-2643WEB
- https://github.com/puppetlabs/puppetPACKAGE
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-1655.ymlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2013-1655ADVISORY
- https://puppetlabs.com/security/cve/cve-2013-1655WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan