Red Hat Security Advisory

RHSA-2013:1283

puppet security update

Released 2013-09-24 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux OpenStack Platform 3.0 facter-1.6.6-1.el6_4, hiera-1.0.0-3.el6_4, puppet-3.2.4-1.el6_4 +3

Fixes 3 records

TI-2013-03115 CVE-2013-3567 · GHSA-f7p5-w2cr-7cp7

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2…

LOW 39

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a cra…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03408 Published 2013-08-19 Partial fix · 2.7.22, 3.2.2 CWE-20

TI-2013-04176 CVE-2013-4761 · GHSA-cj43-9h3w-v976

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and…

LOW 27

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.01643 Published 2013-08-20 Partial fix · 2.7.23, 3.2.4

TI-2013-04336 CVE-2013-4956 · GHSA-3jgg-vqj7-2c3r

Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4…

LOW 17

Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were us…

CVSS 2.0LOW 3.6 Local No auth Interaction — EPSS 0.00381 Published 2013-08-20 Fixed CWE-264