cbcvebase.
CVE-2013-3567
published 2013-08-19

CVE-2013-3567: Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to…

high7.5CVSS 3.1
AVNACLAuNCPIPAP
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

Affected

40 ranges· showing 25
VendorProductVersion rangeFixed in
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debianpuppet< puppet 3.2.2-1 (bullseye)puppet 3.2.2-1 (bullseye)
novellsuse_linux_enterprise_desktop
novellsuse_linux_enterprise_desktop
novellsuse_linux_enterprise_server
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet
puppetpuppet>= 0 < 3.2.2-13.2.2-1
puppetpuppet>= 2.7.0 < 2.7.222.7.22
puppetpuppet>= 3.2.0 < 3.2.23.2.2
puppetpuppet_enterprise<= 2.8.1
puppetpuppet_enterprise
puppetpuppet_enterprise
puppetpuppet_enterprise

CVSS provenance

nvd7.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH