Description
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 3.2.2-1 | — |
| Debian 7 | puppet | 2.7.18-5 | DSA-2715-1 |
| Debian 6.0 | puppet | 2.6.2-5+squeeze8 | DSA-2715-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 3 | facter | 1.6.6-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | hiera | 1.0.0-3.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | puppet +1 | 3.2.4-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby-augeas | 0.4.1-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby-shadow | 1.4.1-13.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby193-puppet +1 | 3.1.1-11.1.el6ost | RHSA-2013:1284 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | >= 2.7.0, < 2.7.22 | 2.7.22 | GHSA-f7p5-w2cr-7cp7 |
| RubyGems | puppet | >= 3.2.0, < 3.2.2 | 3.2.2 | GHSA-f7p5-w2cr-7cp7 |
Advisories 3
- RHSA-2013:1284 Red Hat Security Advisory: ruby193-puppet security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1283 Red Hat Security Advisory: puppet security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2715-1 puppet - code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 54429 third-party-advisory
- SUSE-SU-2013:1304 vendor-advisory
- openSUSE-SU-2013:1370 vendor-advisory
- DSA-2715 vendor-advisory
- USN-1886-1 vendor-advisory
- https://puppetlabs.com/security/cve/cve-2013-3567/
- RHSA-2013:1284 vendor-advisory
- RHSA-2013:1283 vendor-advisory