Mailinglist Archive: opensuse-bugs (2746 mails)

< Previous Next >
[Bug 825878] New: Puppet CVE-2013-3567 (Unauthenticated Remote Code Execution Vulnerability)
  • From: bugzilla_noreply@xxxxxxxxxx
  • Date: Thu, 20 Jun 2013 08:15:29 +0000
  • Message-id: <>

Summary: Puppet CVE-2013-3567 (Unauthenticated Remote Code
Execution Vulnerability)
Classification: openSUSE
Product: openSUSE 12.3
Version: Final
Platform: Other
OS/Version: openSUSE 12.3
Status: NEW
Severity: Critical
Priority: P5 - None
Component: Security
AssignedTo: security-team@xxxxxxx
ReportedBy: boris@xxxxxxxxx
QAContact: qa-bugs@xxxxxxx
Found By: ---
Blocker: ---

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:21.0) Gecko/20100101

When making REST api calls, the puppet master takes YAML from an untrusted
client, deserializes it, and then calls methods on the resulting object. A YAML
payload can be crafted to cause the deserialization to construct an instance of
any class available in the ruby process, which allows an attacker to execute
code contained in the payload.

Reproducible: Always

Steps to Reproduce:

Configure bugmail:
------- You are receiving this mail because: -------
You are on the CC list for the bug.

< Previous Next >