MGASA-2013-0187

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2013-0187.html
Import Source
https://advisories.mageia.org/MGASA-2013-0187.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2013-0187
Related
Published
2013-06-26T18:36:33Z
Modified
2013-06-26T18:36:29Z
Summary
Updated puppet packages fix remote code execution vulnerability
Details

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

References
Credits

Affected packages

Mageia:2 / puppet

Package

Name
puppet
Purl
pkg:rpm/mageia/puppet?distro=mageia-2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.22-1.mga2

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / puppet

Package

Name
puppet
Purl
pkg:rpm/mageia/puppet?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.22-1.mga3

Ecosystem specific 

{
    "section": "core"
}

Mageia:3 / puppet3

Package

Name
puppet3
Purl
pkg:rpm/mageia/puppet3?distro=mageia-3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.2-1.mga3

Ecosystem specific 

{
    "section": "core"
}