GHSA-574q-fxfj-wv6h

Suggest an improvement
Source
https://github.com/advisories/GHSA-574q-fxfj-wv6h
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-574q-fxfj-wv6h/GHSA-574q-fxfj-wv6h.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-574q-fxfj-wv6h
Aliases
Published
2017-10-24T18:33:37Z
Modified
2024-11-29T05:41:52.534442Z
Summary
Puppet Improper Input Validation vulnerability
Details

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

Database specific 
{
    "nvd_published_at": "2013-03-20T16:55:01Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:00:17Z"
}
References

Affected packages

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.7.0
Fixed
2.7.21

Affected versions

2.*

2.7.1
2.7.3
2.7.4
2.7.5
2.7.6
2.7.8
2.7.9
2.7.11
2.7.12
2.7.13
2.7.14
2.7.16
2.7.17
2.7.18
2.7.19
2.7.20.rc1
2.7.20

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.1.0
Fixed
3.1.1

Affected versions

3.*

3.1.0