Bug 974649 (CVE-2013-3567)

Summary:	CVE-2013-3567 puppet: remote code execution on master from unauthenticated clients
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, bhu, bkearney, bressers, ccoleman, chrisw, cpelland, dajohnso, dallan, dmcphers, esammons, fedora, gkotton, gmollett, iboverma, jeckersb, jialiu, jomara, jose.p.oliveira.oss, jross, jrusnack, katello-bugs, katello-internal, k.georgiou, kseifried, ktdreyer, lhh, lmeyer, markmc, mastahnke, matt, mcressma, mmagr, mmccune, morazi, moses, mrg-program-list, msuchy, nixon, rbryant, rharriso, rhos-maint, sclewis, security-response-team, skottler, tdawson, tkramer, tmz, vanmeeuwen+fedora, williams, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	puppet 2.7.22, puppet 3.2.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-03-12 04:55:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	974664, 975814, 975816, 995656, 1002315, 1002345, 1002347, 1007056
Bug Blocks:	974651

Description Vincent Danen 2013-06-14 17:33:46 UTC

When making REST api calls, the puppet master takes YAML from an untrusted
client, deserializes it, and then calls methods on the resulting object. A YAML
payload can be crafted to cause the deserialization to construct an instance of
any class available in the ruby process, which allows an attacker to execute
code contained in the payload.

Comment 5 Tomas Hoger 2013-06-19 07:44:39 UTC

External Reference:

http://puppetlabs.com/security/cve/cve-2013-3567/

Comment 6 Jan Lieskovsky 2013-06-19 12:11:06 UTC

Created puppet tracking bugs for this issue

Affects: fedora-all [bug 975814]
Affects: epel-all [bug 975816]

Comment 10 Kurt Seifried 2013-07-26 07:38:44 UTC

The Red Hat Security Response Team has rated this issue as having moderate security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates.

Comment 22 Murray McAllister 2013-09-12 12:59:28 UTC

Acknowledgements:

Red Hat would like to thank Puppet Labs for reporting this issue. Upstream acknowledges Ben Murphy as the original reporter.

Comment 23 errata-xmlrpc 2013-09-24 18:02:50 UTC

This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1283 https://rhn.redhat.com/errata/RHSA-2013-1283.html

Comment 24 errata-xmlrpc 2013-09-24 18:13:32 UTC

This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1284 https://rhn.redhat.com/errata/RHSA-2013-1284.html