CVEvulnerability

CVE-2017-2295

8.2 HIGH Published 2017-07-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-07-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.2 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-502

Description

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

Affected configurations

• puppet puppet (<= 4.10.0) • debian debian linux 8.0

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References