GitHub Advisoryadvisory · RubyGems
GHSA-574q-fxfj-wv6h Puppet Improper Input Validation vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2013-1655
- Ecosystem
- RubyGems
- Packages
- puppet
- Severity
- High
- Weaknesses
- CWE-20
- Reviewed
- 2020-06-16
Affected packages
• RubyGems puppet: >= 2.7.0, < 2.7.21 → fixed in 2.7.21
• RubyGems puppet: >= 3.1.0, < 3.1.1 → fixed in 3.1.1
Description
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
Related
Alias · CVE (1)
- CVE-2013-1655 Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-1655 advisory
- https://github.com/puppetlabs/puppet package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-1655.yml web
- https://puppetlabs.com/security/cve/cve-2013-1655 web
- https://web.archive.org/web/20200228144801/http://www.securityfocus.com/bid/58442 web
- https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability web
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html web
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html web
- http://ubuntu.com/usn/usn-1759-1 web
- http://www.debian.org/security/2013/dsa-2643 web