CVE-2013-3567

N/A Unknown

Published: August 19, 2013 Modified: April 29, 2026

Description

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2013-1283.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2013-1284.html

Source: cve@mitre.org

http://secunia.com/advisories/54429

Source: cve@mitre.org

Vendor Advisory

http://www.debian.org/security/2013/dsa-2715

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-1886-1

Source: cve@mitre.org

https://puppetlabs.com/security/cve/cve-2013-3567/

Source: cve@mitre.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html