Unscored severity · published Aug 19, 2013
CVE-2013-3567
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby…
–
CVSS
3.4%
EPSS
No
On KEV
Description
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Puppet · Puppet
2.7.2; 2.7.10; 2.7.11; 2.7.12; 2.7.13; 2.7.14; +5 more · source: NVD
PE
Puppet Enterprise · Puppet
through 2.8.1; 1.0; 1.1; 1.2.0; 2.0.0; 2.5.1; +2 more · source: NVD
SL
Suse Linux Enterprise Desktop · Novell
11; 11.0 · source: NVD
SL
Suse Linux Enterprise Server · Novell
11.0; 11.0; 11.0 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 12.10; 13.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3567
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1283.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-1284.html
Vendor Advisory
http://secunia.com/advisories/54429
www.debian.org
http://www.debian.org/security/2013/dsa-2715
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation