CVE-2013-3567

NameCVE-2013-3567
DescriptionPuppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2715-1
NVD severityhigh (attack range: remote)
Debian Bugs712745
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
puppet (PTS)squeeze (security), squeeze2.6.2-5+squeeze9fixed
squeeze (lts)2.6.2-5+squeeze10fixed
wheezy, wheezy (security)2.7.23-1~deb7u3fixed
jessie, sid3.7.2-2fixed

The information above is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
puppetsource(unstable)3.2.2-1high712745
puppetsourcesqueeze2.6.2-5+squeeze8highDSA-2715-1
puppetsourcewheezy2.7.18-5highDSA-2715-1

Search for package or bug name: Reporting problems