Description
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | 3.2.4-1 | — |
| Debian 7 | puppet | 2.7.23-1~deb7u1 | DSA-2761-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 3 | facter | 1.6.6-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | hiera | 1.0.0-3.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | puppet +1 | 3.2.4-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby-augeas | 0.4.1-1.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby-shadow | 1.4.1-13.el6_4 | RHSA-2013:1283 |
| Red Hat OpenStack 3 | ruby193-puppet +1 | 3.1.1-11.1.el6ost | RHSA-2013:1284 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | >= 2.7.0, < 2.7.23 | 2.7.23 | GHSA-cj43-9h3w-v976 |
| RubyGems | puppet | >= 3.2.0, < 3.2.4 | 3.2.4 | GHSA-cj43-9h3w-v976 |
Advisories 3
- RHSA-2013:1284 Red Hat Security Advisory: ruby193-puppet security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1283 Red Hat Security Advisory: puppet security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2761-1 puppet - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2761 vendor-advisory
- SUSE-SU-2014:0155 vendor-advisory
- http://puppetlabs.com/security/cve/cve-2013-4761/
- RHSA-2013:1284 vendor-advisory
- RHSA-2013:1283 vendor-advisory