Read the docs
TI-2013-04176 Aliases CVE-2013-4761GHSA-cj43-9h3w-v976

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and…

Priority LOW 27Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.

Why it matters now

EPSS 0.01643 76th percentileScored 2026-11-07
Fix Partial puppet (RubyGems): 2.7.23, 3.2.4Red Hat: 2 advisoriesRed Hat: 1 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—puppet (RubyGems)2.7.0 to before 2.7.232.7.23Patch availableGHSA-cj43-9h3w-v976
—puppet (RubyGems)3.2.0 to before 3.2.43.2.4Patch availableGHSA-cj43-9h3w-v976
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • puppet (RubyGems) Vendor— Affected 2.7.0 to before 2.7.23 Fixed in 2.7.23 Patch available GHSA-cj43-9h3w-v976
  • puppet (RubyGems) Vendor— Affected 3.2.0 to before 3.2.4 Fixed in 3.2.4 Patch available GHSA-cj43-9h3w-v976

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*3.2.1VulnerablePuppet
cpe:2.3:a:puppet:puppet:3.2.2:*:*:*:*:*:*:*3.2.2VulnerablePuppet
cpe:2.3:a:puppet:puppet:3.2.3:*:*:*:*:*:*:*3.2.3VulnerablePuppet
cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*3.2.0VulnerablePuppetlabs
cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*2.7.2VulnerablePuppet
cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*2.7.0VulnerablePuppetlabs
cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*2.7.1VulnerablePuppetlabs
cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*2.8.0VulnerablePuppet
cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:*2.8.1VulnerablePuppet
cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:*2.8.2VulnerablePuppet
  • cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Puppet
  • cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Puppetlabs
  • cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·Puppet
  • cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Puppetlabs
  • cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Puppetlabs
  • cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet_enterprise:2.8.1:*:*:*:*:*:*:* Versions 2.8.1 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet_enterprise:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·Puppet
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:puppet:puppet_enterprise:3.0.0:*:*:*:*:*:*:*3.0.0VulnerablePuppet
  • cpe:2.3:a:puppet:puppet_enterprise:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Puppet

Remediation

  • Fix · GHSA-cj43-9h3w-v976 puppet (RubyGems) Fixed in 2.7.23 Advisory →
  • Fix · GHSA-cj43-9h3w-v976 puppet (RubyGems) Fixed in 3.2.4 Advisory →

Red Hat 2 advisories

  • RHSA-2013:1284 Released 2013-09-24 · Red Hat rating Critical
    ruby193-puppet security update
    • Red Hat Enterprise Linux OpenStack Platform 3.0 ruby193-puppet-3.1.1-11.1.el6ost, ruby193-puppet-server-3.1.1-11.1.el6ost
  • RHSA-2013:1283 Released 2013-09-24 · Red Hat rating Moderate
    puppet security update
    • Red Hat Enterprise Linux OpenStack Platform 3.0 facter-1.6.6-1.el6_4, hiera-1.0.0-3.el6_4, puppet-3.2.4-1.el6_4 +3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix yet
Red Hat Enterprise MRG 1AffectedNo fix yet
Red Hat OpenStack Platform 4AffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix yet
Red Hat Enterprise Linux OpenStack Platform 3.0Fixed RHSA-2013:1283, RHSA-2013:1284

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-4761
  2. 2026-10-03 Alias added: GHSA-cj43-9h3w-v976

References

Advisory 6

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences