GHSA-cj43-9h3w-v976
Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service
At a glance
- Published
- Updated
- CVE
- CVE-2013-4761
Description
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
Affected packages
| Package | Versions |
|---|---|
| RubyGems · puppet | introduced 2.7.0, fixed 2.7.23 |
| RubyGems · puppet | introduced 3.2.0, fixed 3.2.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4761 ADVISORY
- https://github.com/puppetlabs/puppet PACKAGE
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-4761.yml WEB
- https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability WEB
- http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html WEB
- http://puppetlabs.com/security/cve/cve-2013-4761 WEB
- http://rhn.redhat.com/errata/RHSA-2013-1283.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-1284.html WEB
- http://www.debian.org/security/2013/dsa-2761 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |