high7.5
CVE-2013-1655
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "…
Impact
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Puppet | Puppet | Versions 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.7 |
| Puppet | Puppet Enterprise | Version 3.1.0 |
| Puppetlabs | Puppet | Versions 2.7.0, 2.7.1, 2.7.19, 2.7.20 |
Weakness classification
References
- NVD record
- CVE.org record
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
- http://secunia.com/advisories/52596
- http://ubuntu.com/usn/usn-1759-1
- http://www.debian.org/security/2013/dsa-2643
- http://www.securityfocus.com/bid/58442
- https://puppetlabs.com/security/cve/cve-2013-1655/
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html
- http://secunia.com/advisories/52596
- http://ubuntu.com/usn/usn-1759-1
- http://www.debian.org/security/2013/dsa-2643
- http://www.securityfocus.com/bid/58442
- https://puppetlabs.com/security/cve/cve-2013-1655/