Skip to content
OpenAdvisories
Unscored RHSA-2013:1283 3 CVEs

Red Hat Security Advisory: puppet security update

Published Sep 15, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · OpenStack 3 openstack:3::el6 facter 0:1.6.6-1.el6_4
Red Hat · OpenStack 3 openstack:3::el6 hiera 0:1.0.0-3.el6_4
Red Hat · OpenStack 3 openstack:3::el6 puppet 0:3.2.4-1.el6_4
Red Hat · OpenStack 3 openstack:3::el6 puppet-server 0:3.2.4-1.el6_4
Red Hat · OpenStack 3 openstack:3::el6 ruby-augeas 0:0.4.1-1.el6_4
Red Hat · OpenStack 3 openstack:3::el6 ruby-augeas-debuginfo 0:0.4.1-1.el6_4
Red Hat · OpenStack 3 openstack:3::el6 ruby-shadow 0:1.4.1-13.el6_4
Red Hat · OpenStack 3 openstack:3::el6 ruby-shadow-debuginfo 0:1.4.1-13.el6_4

Vulnerabilities 3

  • High —
    CVE-2013-3567

    Puppet Improper Input Validation vulnerability

    Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

    puppet puppet Debian RubyGems
  • Medium —
    CVE-2013-4761

    Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service

    Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: th…

    puppet puppet Debian RubyGems
  • Unscored —
    CVE-2013-4956

    Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x bef…

    puppet Debian

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=974649
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=996855
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=996856
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1283.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-3567
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-3567
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-3567
  • article
    http://puppetlabs.com/security/cve/cve-2013-3567/
  • report
    https://access.redhat.com/security/cve/CVE-2013-4761
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4761
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4761
  • article
    http://puppetlabs.com/security/cve/cve-2013-4761/
  • report
    https://access.redhat.com/security/cve/CVE-2013-4956
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4956
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4956
  • article
    http://puppetlabs.com/security/cve/cve-2013-4956/