CVEvulnerability
CVE-2013-1640
9.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2013-03-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Description
The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.
Affected configurations
• puppet puppet (< 2.6.18)
• puppet puppet (>= 2.7.0 < 2.7.21)
• puppet puppet 3.1.0
• puppet puppet enterprise (< 1.2.7)
• puppet puppet enterprise 2.7.0
• puppet puppet enterprise 2.7.1
• canonical ubuntu linux 11.10
• canonical ubuntu linux 12.04
• canonical ubuntu linux 12.10
References
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0710.html Third Party Advisory
- http://secunia.com/advisories/52596 Third Party Advisory
- http://ubuntu.com/usn/usn-1759-1 Third Party Advisory
- http://www.debian.org/security/2013/dsa-2643 Third Party Advisory
- https://puppetlabs.com/security/cve/cve-2013-1640/ Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-0710.html Third Party Advisory
- http://secunia.com/advisories/52596 Third Party Advisory
- http://ubuntu.com/usn/usn-1759-1 Third Party Advisory
- http://www.debian.org/security/2013/dsa-2643 Third Party Advisory
- https://puppetlabs.com/security/cve/cve-2013-1640/ Vendor Advisory