Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service
Moderate severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Nov 10, 2023
Package
Affected versions
>= 2.7.0, < 2.7.23
>= 3.2.0, < 3.2.4
Patched versions
2.7.23
3.2.4
Description
Published by the National Vulnerability Database
Aug 20, 2013
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Nov 10, 2023
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.
References