Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-3567US | high7.5 | — | ||
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby clas… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2013-1283.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2013-1284.htmlWEB
- http://www.debian.org/security/2013/dsa-2715WEB
- http://www.ubuntu.com/usn/USN-1886-1WEB
- https://github.com/puppetlabs/puppetPACKAGE
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-3567.ymlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan