Lucene search

GitHub Advisory DatabaseGHSA-574Q-FXFJ-WV6H

HistoryOct 24, 2017 - 6:33 p.m.

Puppet Improper Input Validation vulnerability

2017-10-2418:33:37

CWE-20

GitHub Advisory Database

github.com

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.096 Low

EPSS

Percentile

94.8%

JSON

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to “serialized attributes.”

Affected configurations

Vulners

Node

puppetpuppetRange<2.7.21

puppetpuppetRange<3.1.1

CPENameOperatorVersion
puppetlt2.7.21
puppetlt3.1.1

CPE	Name	Operator	Version
	puppet	lt	2.7.21
	puppet	lt	3.1.1

References

lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html

lists.opensuse.org/opensuse-updates/2013-04/msg00056.html

ubuntu.com/usn/usn-1759-1

www.debian.org/security/2013/dsa-2643

github.com/advisories/GHSA-574q-fxfj-wv6h

github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-1655.yml

nvd.nist.gov/vuln/detail/CVE-2013-1655

puppetlabs.com/security/cve/cve-2013-1655/

web.archive.org/web/20200228144801/www.securityfocus.com/bid/58442

www.puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.096 Low

EPSS

Percentile

94.8%

JSON

Related for GHSA-574Q-FXFJ-WV6H