Deserialization of Untrusted Data Affecting puppet package, versions <4.10.1
Threat Intelligence
EPSS
0.24% (65th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-PUPPET-472666
- published 7 Nov 2019
- disclosed 11 May 2017
- credit Puppet
Introduced: 11 May 2017
CVE-2017-2295 Open this link in a new tabHow to fix?
Upgrade puppet to version 4.10.1 or higher.
Overview
puppet is an automated configuration management tool.
Affected versions of this package are vulnerable to Deserialization of Untrusted Data. It allows deserializing data off the wire (from the agent to the server, in this case) with an attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.
CVSS Scores
version 3.1