https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c1 Alexander Bergmann changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |boris@steki.net, | |dlovasko@suse.com, | |nkrinner@suse.com AssignedTo|security-team@suse.de |jatan@suse.com Summary|Puppet CVE-2013-3567 |VUL-0: puppet: |(Unauthenticated Remote |CVE-2013-3567: |Code Execution |Unauthenticated Remote Code |Vulnerability) |Execution Vulnerability Alias| |CVE-2013-3567 --- Comment #1 from Alexander Bergmann 2013-06-20 02:38:15 UTC --- Status: Resolved in Puppet 2.7.22, 3.2.2 Resolved in Puppet Enterprise 2.8.2 Credits: Credit to Ben Murphy for the responsible disclosure of this vulnerability. ---- openSUSE:12.2: puppet-2.7.6 openSUSE:12.3: puppet-3.0.2 SLE11-SP2: puppet-2.6.18-0.4.2 SLE11-SP1: puppet-2.6.17-0.3.1 SLE10: Not used in any sle10 version. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c3 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:running:53262:critica | |l --- Comment #3 from Swamp Workflow Management 2013-06-26 06:48:17 UTC --- The SWAMPID for this issue is 53262. This issue was rated as critical. Please submit fixed packages until 2013-06-28. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c6 --- Comment #6 from Marcus Meissner 2013-07-10 14:26:16 UTC --- ping? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c7 --- Comment #7 from Wojtek Dziewięcki 2013-07-18 11:33:30 UTC --- Sorry for the late response, I was on vacation. I believe that puppet 2.6.18 in SLE is not affected, because Puppetlabs didn't release new 2.6 version and also according to this site: http://www.securityfocus.com/bid/60664 I'll fix it in openSUSE soon. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c9 --- Comment #9 from Wojtek Dziewięcki 2013-07-18 15:25:43 UTC --- No I don't know anyone in puppet labs. I've been looking for a way to extract a patch myself now. Should I try to find a contact or mailing list on their web page? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c11 --- Comment #11 from Wojtek Dziewięcki 2013-07-19 12:00:58 UTC --- 3.2.2. release notes say: 3.2.2 is a security fix release of the Puppet 3.2 series. It has no other bug fixes or new features. So I think we can just use the diff you extracted as patch, I'm on it now, thanks. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c14 --- Comment #14 from Matthias Weckbecker 2013-07-29 11:47:45 CEST --- -24 days SLA. Any news here? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c19 --- Comment #19 from Bernhard Wiedemann 2013-08-05 15:00:40 CEST --- This is an autogenerated message for OBS integration: This bug (825878) was mentioned in https://build.opensuse.org/request/show/185935 Maintenance / -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c21 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:53262:critica |maint:running:53262:critica |l |l |maint:released:sle11-sp1:53 |maint:released:sle11-sp1:53 |263 |263 | |maint:released:sle11-sp2:53 | |264 --- Comment #21 from Swamp Workflow Management 2013-08-06 14:49:57 UTC --- Update released for: puppet, puppet-server Products: SLE-DESKTOP 11-SP2 (i386, x86_64) SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64) SLES4VMWARE 11-SP2 (i386, x86_64) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c23 --- Comment #23 from Bernhard Wiedemann 2013-08-09 15:00:10 CEST --- This is an autogenerated message for OBS integration: This bug (825878) was mentioned in https://build.opensuse.org/request/show/186578 Maintenance / -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c24 --- Comment #24 from Bernhard Wiedemann 2013-08-12 16:00:10 CEST --- This is an autogenerated message for OBS integration: This bug (825878) was mentioned in https://build.opensuse.org/request/show/186737 Maintenance / -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:released:sle11-sp1:53 |maint:released:sle11-sp1:53 |263 |263 |maint:released:sle11-sp3:53 |maint:released:sle11-sp3:53 |265 |265 |obs:running:1940:moderate |obs:running:1940:critical -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:released:sle11-sp1:53 |maint:released:sle11-sp1:53 |263 |263 |maint:released:sle11-sp3:53 |maint:released:sle11-sp3:53 |265 |265 |obs:running:1940:critical | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=825878 https://bugzilla.novell.com/show_bug.cgi?id=825878#c27 Sebastian Krahmer changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED --- Comment #27 from Sebastian Krahmer 2013-12-23 12:26:02 UTC --- Why's this still open? SWAMP is finished, openSUSE released -> closing. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.