Homepage
About Snyk

Deserialization of Untrusted Data Affecting puppet package, versions <4.10.1

0.0
high

Snyk CVSS

    Attack Complexity High
    Scope Changed
    Confidentiality High
    Integrity High

    Threat Intelligence

    EPSS 0.24% (65th percentile)
Expand this section
NVD
8.2 high
Expand this section
Red Hat
8.1 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-PUPPET-472666
  • published 7 Nov 2019
  • disclosed 11 May 2017
  • credit Puppet
Report a new vulnerability Found a mistake?

Introduced: 11 May 2017

CVE-2017-2295 Open this link in a new tab
CWE-502 Open this link in a new tab

How to fix?

Upgrade puppet to version 4.10.1 or higher.

Overview

puppet is an automated configuration management tool.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It allows deserializing data off the wire (from the agent to the server, in this case) with an attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.