CVE-2013-3567: Input Validation
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-3567?
CVE-2013-3567 is considered a critical vulnerability due to the potential for remote code execution.
How do I fix CVE-2013-3567?
To fix CVE-2013-3567, upgrade Puppet to version 2.7.22 or 3.2.2, or use a later version.
What versions of Puppet are affected by CVE-2013-3567?
Affected versions include Puppet 2.7.x prior to 2.7.22, Puppet 3.2.x prior to 3.2.2, and Puppet Enterprise prior to 2.8.2.
What types of attacks can exploit CVE-2013-3567?
CVE-2013-3567 can be exploited by sending a crafted REST API call that deserializes untrusted YAML.
How was CVE-2013-3567 discovered?
CVE-2013-3567 was discovered through the identification of unsafe deserialization patterns in Puppet's handling of YAML.