NetSight
IP …
high7.5

CVE-2013-3567

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiat…

Impact

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

Affected products

VendorProductAffected versions
PuppetPuppet
Versions 2.7.2, 2.7.10, 2.7.11, 2.7.12, 2.7.13, 2.7.14
PuppetlabsPuppet
Versions 2.7.0, 2.7.1, 2.7.19, 2.7.20, 3.2.0, 1.0.0
CanonicalUbuntu Linux
Versions 12.04, 12.10, 13.04
NovellSuse Linux Enterprise Desktop
Versions 11, 11.0
NovellSuse Linux Enterprise Server
Version 11.0
PuppetPuppet Enterprise
through 2.8.1
Versions 1.0, 1.1, 1.2.0, 2.0.0, 2.5.1

Weakness classification

CWE-20

References