Skip to content
OpenAdvisories
Unscored CVE-2017-2295 EUVD-2017-11478GHSA-988w-9qqw-43hr

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specifie…

Published Jul 5, 2017 · Updated Sep 16, 2024 · Assigned by puppet

Vendor: Puppet Product: Puppet server Package: puppet Package: puppet Ecosystem: Debian Ecosystem: Ubuntu

Description

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

Affected products

VendorProductAffectedFixed
Puppet Puppet server Puppet prior to 4.10.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 11 puppet 4.8.2-5 —
Debian 8 puppet 3.7.2-4+deb8u1 DSA-3862-1
Debian 7 puppet 2.7.23-1~deb7u4 DLA-1012-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS puppet 3.4.3-1ubuntu1.2 USN-3308-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS puppet 3.8.5-2ubuntu0.1+esm1 USN-4804-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 foreman +1 1.15.6.34-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 201801241201-2.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 foreman-discovery-image 1:3.4.4-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 foreman-installer 1:1.15.6.8-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 foreman-proxy 1.15.6.4-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 foreman-selinux 1.15.6.2-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 hiera 1.3.1-2.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 katello +3 3.4.5-15.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 katello-certs-tools 2.4.0-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.5.1-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 katello-installer-base +1 3.4.5.26-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 katello-selinux 3.0.2-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 kobo 0.5.1-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 pulp +13 2.13.4.6-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 pulp-docker +3 2.4.1-2.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 pulp-katello 1.0.2-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 pulp-ostree +3 1.2.1.1-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 pulp-puppet +3 2.13.4-3.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 pulp-rpm +3 2.13.4.8-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 0.3.16-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 python-zope-interface 4.0.5-4.el7 RHSA-2018:0336
Red Hat Satellite Capsule 6 redhat-access-insights-puppet 0.0.9-2.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-kafo 2.0.2-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-kafo_parsers +1 0.1.6-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-kafo_wizards 0.0.1-2.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-smart_proxy_dhcp_remote_isc 0.0.2.1-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-smart_proxy_discovery 1.0.4-3.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-smart_proxy_discovery_image 1.0.9-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-smart_proxy_dynflow 0.1.10-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-smart_proxy_openscap 0.6.9-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-smart_proxy_pulp 1.3.0-1.git.0.b5c2768.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 rubygem-tilt 1.3.7-2.git.0.3b416c9.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 satellite +3 6.3.0-23.0.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 satellite-installer 6.3.0.12-1.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 tfm-rubygem-foreman-tasks-core 0.1.8-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 tfm-rubygem-foreman_remote_execution_core 1.0.6-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dynflow_core 0.1.10-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 candlepin +1 2.1.14-1.el7 RHSA-2018:0336
Red Hat Satellite 6 foreman +11 1.15.6.34-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 foreman-bootloaders-redhat +1 201801241201-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 foreman-discovery-image 1:3.4.4-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 foreman-installer 1:1.15.6.8-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 foreman-proxy 1.15.6.4-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 foreman-selinux 1.15.6.2-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 hiera 1.3.1-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 katello +4 3.4.5-15.el7sat RHSA-2018:0336
Red Hat Satellite 6 katello-certs-tools 2.4.0-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 katello-client-bootstrap 1.5.1-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 katello-installer-base +1 3.4.5.26-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 katello-selinux 3.0.2-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 kobo 0.5.1-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 pulp +9 2.13.4.6-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 pulp-docker +3 2.4.1-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 pulp-katello 1.0.2-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 pulp-ostree +3 1.2.1.1-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 pulp-puppet +4 2.13.4-3.el7sat RHSA-2018:0336
Red Hat Satellite 6 pulp-rpm +3 2.13.4.8-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 puppet-foreman_scap_client 0.3.16-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 python-zope-interface 4.0.5-4.el7 RHSA-2018:0336
Red Hat Satellite 6 redhat-access-insights-puppet 0.0.9-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-foreman_scap_client 0.3.0-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-kafo 2.0.2-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-kafo_parsers +1 0.1.6-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-kafo_wizards 0.0.1-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-smart_proxy_dhcp_remote_isc 0.0.2.1-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-smart_proxy_discovery 1.0.4-3.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-smart_proxy_discovery_image 1.0.9-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-smart_proxy_dynflow 0.1.10-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-smart_proxy_openscap 0.6.9-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-smart_proxy_pulp 1.3.0-1.git.0.b5c2768.el7sat RHSA-2018:0336
Red Hat Satellite 6 rubygem-tilt 1.3.7-2.git.0.3b416c9.el7sat RHSA-2018:0336
Red Hat Satellite 6 satellite +4 6.3.0-23.0.el7sat RHSA-2018:0336
Red Hat Satellite 6 satellite-installer 6.3.0.12-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-bastion 5.1.1.4-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman-redhat_access 2.0.13-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman-tasks 0.9.6.4-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman-tasks-core 0.1.8-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_bootdisk 10.0.2.2-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_discovery 9.1.5.3-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_docker 3.1.0.3-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_hooks 0.3.14-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_openscap 0.7.11-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_remote_execution 1.3.7.2-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_remote_execution_core 1.0.6-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_templates 5.0.1-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_theme_satellite 1.0.4.16-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-foreman_virt_who_configure 0.1.9-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli 0.11.0.1-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_csv 2.3.0-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman 0.11.0.5-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_admin 0.0.8-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_bootdisk 0.1.3.3-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_discovery 1.0.0-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_docker 0.0.6-2.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_openscap 0.1.5-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_remote_execution 0.0.6-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_tasks 0.0.12-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_foreman_virt_who_configure 0.0.3-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-hammer_cli_katello 0.11.3.5-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-katello +1 3.4.5.58-1.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-ovirt_provision_plugin 1.0.2-1.fm1_15.el7sat RHSA-2018:0336
Red Hat Satellite 6 tfm-rubygem-smart_proxy_dynflow_core 0.1.10-1.fm1_15.el7sat RHSA-2018:0336

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP3 puppet 3.8.5-15.3.3 SUSE-SU-2017:2113-1
SLES 12 SP2 puppet 3.8.5-15.3.3 SUSE-SU-2017:2113-1
SLES 12 puppet 3.8.5-15.3.3 SUSE-SU-2017:2113-1
SLES 11 SP4 puppet 2.7.26-0.5.3.1 SUSE-SU-2018:0600-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 11 SP4 puppet 2.7.26-0.5.3.1 SUSE-SU-2018:0600-1

Advisories 7

References