CVE-2017-2295

EUVD-2017-11478
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.2 HIGH
NETWORK
HIGH
LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
Affected Products (NVD)
VendorProductVersion
puppetpuppet
𝑥
≤ 4.10.0
debiandebian_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
puppet
bullseye
5.5.22-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
puppet
artful
not-affected
bionic
not-affected
cosmic
not-affected
disco
not-affected
eoan
not-affected
focal
not-affected
groovy
not-affected
hirsute
not-affected
impish
not-affected
jammy
not-affected
trusty
Fixed 3.4.3-1ubuntu1.2
released
xenial
Fixed 3.8.5-2ubuntu0.1+esm1
released
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://www.debian.org/security/2017/dsa-3862
http://www.securityfocus.com/bid/98582
https://puppet.com/security/cve/cve-2017-2295
http://www.debian.org/security/2017/dsa-3862
http://www.securityfocus.com/bid/98582
https://puppet.com/security/cve/cve-2017-2295