Bug 974649 (CVE-2013-3567) - CVE-2013-3567 puppet: remote code execution on master from unauthenticated clients
Summary: CVE-2013-3567 puppet: remote code execution on master from unauthenticated cl...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-3567
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 974664 975814 975816 995656 1002315 1002345 1002347 1007056
Blocks: 974651
TreeView+ depends on / blocked
 
Reported: 2013-06-14 17:33 UTC by Vincent Danen
Modified: 2023-05-13 01:47 UTC (History)
54 users (show)

Fixed In Version: puppet 2.7.22, puppet 3.2.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-03-12 04:55:56 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:1283 0 normal SHIPPED_LIVE Moderate: puppet security update 2013-09-24 22:00:50 UTC
Red Hat Product Errata RHSA-2013:1284 0 normal SHIPPED_LIVE Critical: ruby193-puppet security update 2013-09-24 22:11:30 UTC

Description Vincent Danen 2013-06-14 17:33:46 UTC 
When making REST api calls, the puppet master takes YAML from an untrusted
client, deserializes it, and then calls methods on the resulting object. A YAML
payload can be crafted to cause the deserialization to construct an instance of
any class available in the ruby process, which allows an attacker to execute
code contained in the payload.
Comment 5 Tomas Hoger 2013-06-19 07:44:39 UTC 
External Reference:

http://puppetlabs.com/security/cve/cve-2013-3567/
Comment 6 Jan Lieskovsky 2013-06-19 12:11:06 UTC 
Created puppet tracking bugs for this issue

Affects: fedora-all [bug 975814]
Affects: epel-all [bug 975816]
Comment 10 Kurt Seifried 2013-07-26 07:38:44 UTC 
The Red Hat Security Response Team has rated this issue as having moderate security impact in CloudForms 1.1. This issue is not currently planned to be addressed in future updates.
Comment 22 Murray McAllister 2013-09-12 12:59:28 UTC 
Acknowledgements:

Red Hat would like to thank Puppet Labs for reporting this issue. Upstream acknowledges Ben Murphy as the original reporter.
Comment 23 errata-xmlrpc 2013-09-24 18:02:50 UTC 
This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1283 https://rhn.redhat.com/errata/RHSA-2013-1283.html
Comment 24 errata-xmlrpc 2013-09-24 18:13:32 UTC 
This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1284 https://rhn.redhat.com/errata/RHSA-2013-1284.html
Note You need to log in before you can comment on or make changes to this bug.