GHSA-574q-fxfj-wv6h

Puppet Improper Input Validation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2013-1655

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	puppet	>= 2.7.0, < 2.7.21	2.7.21
RubyGems	puppet	>= 3.1.0, < 3.1.1	3.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-1655 advisory
https://github.com/puppetlabs/puppet package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-1655.yml web
https://puppetlabs.com/security/cve/cve-2013-1655 web
https://web.archive.org/web/20200228144801/http://www.securityfocus.com/bid/58442 web
https://www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability web
http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html web
http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html web
http://ubuntu.com/usn/usn-1759-1 web
http://www.debian.org/security/2013/dsa-2643 web