Moses Mendoza (moses) reports: CVE-2013-1653 - Remote code execution * Affected versions: 2.7.0 and greater * Patched versions: 2.7.x, 3.1.x A bug in Puppet allows authenticated clients to execute arbitrary code on Puppet agents that accept kick connections. Puppet agents are not vulnerable in their default configuration. However, if the Puppet agent is configured to listen for incoming connections, e.g. listen = true, and the agent's auth.conf allows access to the `run` REST endpoint, then an authenticated client can construct an HTTP PUT request to execute arbitrary code on the agent. This issue is made worse by the fact that puppet agents typically run as root. External References: https://puppetlabs.com/security/cve/cve-2013-1653/
Created puppet tracking bugs for this issue Affects: fedora-all [bug 920845]
For the puppet roll-up patches please see Bz 919783 for the patch files.
puppet-3.1.1-1.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.