CVE-2013-1655

NameCVE-2013-1655
DescriptionPuppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2643-1
NVD severityhigh (attack range: remote)
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
puppet (PTS)squeeze (security), squeeze2.6.2-5+squeeze9fixed
squeeze (lts)2.6.2-5+squeeze10fixed
wheezy, wheezy (security)2.7.23-1~deb7u3fixed
jessie, sid3.7.2-2fixed

The information above is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
puppetsource(unstable)2.7.18-3high
puppetsourcesqueeze2.6.2-5+squeeze7highDSA-2643-1
Search for package or bug name: Reporting problems