GHSA-f7p5-w2cr-7cp7

Suggest an improvement
Source
https://github.com/advisories/GHSA-f7p5-w2cr-7cp7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-f7p5-w2cr-7cp7/GHSA-f7p5-w2cr-7cp7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f7p5-w2cr-7cp7
Aliases
Published
2017-10-24T18:33:37Z
Modified
2024-02-16T08:17:46.440817Z
Summary
Puppet Improper Input Validation vulnerability
Details

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

References

Affected packages

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.7.0
Fixed
2.7.22

Affected versions

2.*

2.7.1
2.7.3
2.7.4
2.7.5
2.7.6
2.7.8
2.7.9
2.7.11
2.7.12
2.7.13
2.7.14
2.7.16
2.7.17
2.7.18
2.7.19
2.7.20.rc1
2.7.20
2.7.21

RubyGems / puppet

Package

Name
puppet
Purl
pkg:gem/puppet

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.2.0
Fixed
3.2.2

Affected versions

3.*

3.2.1.rc1
3.2.1