Improper input validation in Novell Suse Linux Enterprise Desktop
CVE-2013-3567
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.034 (87.6th percentile) — read the EPSS interpretation.
Affected products
- Novell Suse_linux_enterprise_desktop — versions 11, 11.0
- Novell Suse_linux_enterprise_server — versions 11.0
- Puppet — versions 2.7.2, 2.7.10, 2.7.11
- Puppet Puppet_enterprise — versions 1.0, 1.1, 1.2.0
- Puppetlabs Puppet — versions 2.7.0, 2.7.1, 2.7.19
- Canonical Ubuntu_linux — versions 12.04, 12.10, 13.04
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (vendor-advisory, x_refsource_SUSE)
- cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
- cve@mitre.org (x_refsource_UBUNTU, vendor-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)