CVE-2017-2295: High severity Puppet Puppet vulnerability
Last updated 24 July 2024
Other sources
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2295?
CVE-2017-2295 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2017-2295?
To remediate CVE-2017-2295, update Puppet to version 4.10.1 or later.
Which versions are affected by CVE-2017-2295?
CVE-2017-2295 affects all Puppet versions prior to 4.10.1.
What can attackers do exploiting CVE-2017-2295?
Exploiting CVE-2017-2295 allows attackers to deserialize data in an unsafe manner, potentially leading to remote code execution.
Is CVE-2017-2295 specific to certain operating systems?
CVE-2017-2295 impacts Puppet software regardless of the operating system, as long as the affected versions are in use.