GitHub Advisoryadvisory · RubyGems
GHSA-cj43-9h3w-v976 Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service
MEDIUM
Official page ↗
- Aliases
- CVE-2013-4761
- Ecosystem
- RubyGems
- Packages
- puppet
- Severity
- Moderate
- Reviewed
- 2020-06-16
Affected packages
• RubyGems puppet: >= 2.7.0, < 2.7.23 → fixed in 2.7.23
• RubyGems puppet: >= 3.2.0, < 3.2.4 → fixed in 3.2.4
Description
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
Related
Alias · CVE (1)
- CVE-2013-4761 Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4761 advisory
- https://github.com/puppetlabs/puppet package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-4761.yml web
- https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability web
- http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html web
- http://puppetlabs.com/security/cve/cve-2013-4761 web
- http://rhn.redhat.com/errata/RHSA-2013-1283.html web
- http://rhn.redhat.com/errata/RHSA-2013-1284.html web
- http://www.debian.org/security/2013/dsa-2761 web