CVE-2013-4761
First published: Tue Aug 20 2013(Updated: )
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Puppet Puppet | =3.2.1 | |
| Puppet Puppet | =3.2.2 | |
| Puppet Puppet | =3.2.3 | |
| Puppetlabs Puppet | =3.2.0 | |
| Puppet Puppet | =2.7.2 | |
| Puppetlabs Puppet | =2.7.0 | |
| Puppetlabs Puppet | =2.7.1 | |
| Puppet Puppet Enterprise | =2.8.0 | |
| Puppet Puppet Enterprise | =2.8.1 | |
| Puppet Puppet Enterprise | =2.8.2 | |
| Puppet Puppet Enterprise | =3.0.0 | |
| rubygems/puppet | >=3.2.0<3.2.4 | 3.2.4 |
| rubygems/puppet | >=2.7.0<2.7.23 | 2.7.23 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html
- http://puppetlabs.com/security/cve/cve-2013-4761/
- http://rhn.redhat.com/errata/RHSA-2013-1283.html
- http://rhn.redhat.com/errata/RHSA-2013-1284.html
- http://www.debian.org/security/2013/dsa-2761
- https://nvd.nist.gov/vuln/detail/CVE-2013-4761
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-4761.yml
- https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability
- https://github.com/advisories/GHSA-cj43-9h3w-v976 (Advisory)
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-cj43-9h3w-v976
- alias/CVE-2013-4761
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/puppet
- canonical/puppet puppet
- version/puppet puppet/3.2.1
- version/puppet puppet/3.2.2
- version/puppet puppet/3.2.3
- vendor/puppetlabs
- canonical/puppetlabs puppet
- version/puppetlabs puppet/3.2.0
- version/puppet puppet/2.7.2
- version/puppetlabs puppet/2.7.0
- version/puppetlabs puppet/2.7.1
- canonical/puppet puppet enterprise
- version/puppet puppet enterprise/2.8.0
- version/puppet puppet enterprise/2.8.1
- version/puppet puppet enterprise/2.8.2
- version/puppet puppet enterprise/3.0.0
- package-manager/rubygems