GitHub Advisoryadvisory · RubyGems

GHSA-f7p5-w2cr-7cp7 Puppet Improper Input Validation vulnerability

HIGH Published 2017-10-24 Modified 2023-05-12 Official page ↗
Aliases
CVE-2013-3567
Ecosystem
RubyGems
Packages
puppet
Severity
High
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• RubyGems puppet: >= 2.7.0, < 2.7.22 → fixed in 2.7.22 • RubyGems puppet: >= 3.2.0, < 3.2.2 → fixed in 3.2.2

Description

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

Related

Alias · CVE (1)

  • CVE-2013-3567 Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References