Homepage
About Snyk

Remote Code Execution Affecting puppet package, versions >=2.7.0, <2.7.22 >=3.0.0, <3.2.2

0.0
high

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 20.86% (97th percentile)
Expand this section
NVD
7.3 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-PUPPET-20325
  • published 28 Feb 2017
  • disclosed 28 Feb 2013
  • credit Puppet Labs
Report a new vulnerability Found a mistake?

Introduced: 28 Feb 2013

CVE-2013-3567 Open this link in a new tab
CWE-94 Open this link in a new tab

Overview

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. An attacker may take advantage of this to craft a YAML payload that will cause the deserialization to construct an instance of any class in the ruby process and execute code from the payload.