Vulnerability Description
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Puppet | Puppet | 2.7.2 |
| Puppetlabs | Puppet | 2.7.0 |
| Canonical | Ubuntu Linux | 12.04 |
| Novell | Suse Linux Enterprise Desktop | 11 |
| Novell | Suse Linux Enterprise Server | 11.0 |
| Puppet | Puppet Enterprise | <= 2.8.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html
- http://rhn.redhat.com/errata/RHSA-2013-1283.html
- http://rhn.redhat.com/errata/RHSA-2013-1284.html
- http://secunia.com/advisories/54429Vendor Advisory
- http://www.debian.org/security/2013/dsa-2715
- http://www.ubuntu.com/usn/USN-1886-1
- https://puppetlabs.com/security/cve/cve-2013-3567/Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html
- http://rhn.redhat.com/errata/RHSA-2013-1283.html
- http://rhn.redhat.com/errata/RHSA-2013-1284.html
- http://secunia.com/advisories/54429Vendor Advisory
- http://www.debian.org/security/2013/dsa-2715
- http://www.ubuntu.com/usn/USN-1886-1
FAQ
What is CVE-2013-3567?
CVE-2013-3567 is a vulnerability with a CVSS score of 7.5 (HIGH). Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbi...
How severe is CVE-2013-3567?
CVE-2013-3567 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-3567?
Check the references section above for vendor advisories and patch information. Affected products include: Puppet Puppet, Puppetlabs Puppet, Canonical Ubuntu Linux, Novell Suse Linux Enterprise Desktop, Novell Suse Linux Enterprise Server.