GHSA-f7p5-w2cr-7cp7

Source

https://github.com/advisories/GHSA-f7p5-w2cr-7cp7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-f7p5-w2cr-7cp7/GHSA-f7p5-w2cr-7cp7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-f7p5-w2cr-7cp7

Aliases

CVE-2013-3567

Published

2017-10-24T18:33:37Z

Modified

2024-11-29T05:36:23.437616Z

Summary

Puppet Improper Input Validation vulnerability

Details

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

Database specific

{
    "nvd_published_at": "2013-08-19T23:55:08Z",
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:34:01Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

RubyGems / puppet

Package

Name: puppet
Purl: pkg:gem/puppet

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.7.0

Fixed

2.7.22

Affected versions

2.*

2.7.1

2.7.3

2.7.4

2.7.5

2.7.6

2.7.8

2.7.9

2.7.11

2.7.12

2.7.13

2.7.14

2.7.16

2.7.17

2.7.18

2.7.19

2.7.20.rc1

2.7.20

2.7.21

RubyGems / puppet

Package

Name: puppet
Purl: pkg:gem/puppet

Affected ranges

Type: ECOSYSTEM
Events: Introduced

3.2.0

Fixed

3.2.2

Affected versions

3.*

3.2.1.rc1

3.2.1