CVE-2017-2295
Fixed in a distro release EPSS 3%
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.
Products: Puppet server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | puppet | 4.8.2-5 |
| Debian 7 | puppet | 2.7.23-1~deb7u4 |
| Debian 8 | puppet | 3.7.2-4+deb8u1 |
| Red Hat satellite 6.3 | candlepin | 0:2.1.14-1.el7 |
| Red Hat satellite 6.3 | candlepin-selinux | 0:2.1.14-1.el7 |
| Red Hat satellite 6.3 | foreman | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-bootloaders-redhat | 0:201801241201-2.el7sat |
| Red Hat satellite 6.3 | foreman-bootloaders-redhat-tftpboot | 0:201801241201-2.el7sat |
| Red Hat satellite 6.3 | foreman-cli | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-compute | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-debug | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-discovery-image | 1:3.4.4-1.el7sat |
| Red Hat satellite 6.3 | foreman-ec2 | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-gce | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-installer | 1:1.15.6.8-1.el7sat |
| Red Hat satellite 6.3 | foreman-installer-katello | 0:3.4.5.26-1.el7sat |
| Red Hat satellite 6.3 | foreman-libvirt | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-openstack | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-ovirt | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-postgresql | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-proxy | 0:1.15.6.4-1.el7sat |
| Red Hat satellite 6.3 | foreman-proxy-content | 0:3.4.5-15.el7sat |
| Red Hat satellite 6.3 | foreman-rackspace | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | foreman-selinux | 0:1.15.6.2-1.el7sat |
| Red Hat satellite 6.3 | foreman-vmware | 0:1.15.6.34-1.el7sat |
| Red Hat satellite 6.3 | hiera | 0:1.3.1-2.el7sat |
| Red Hat satellite 6.3 | katello | 0:3.4.5-15.el7sat |
| Red Hat satellite 6.3 | katello-certs-tools | 0:2.4.0-1.el7sat |
| Red Hat satellite 6.3 | katello-client-bootstrap | 0:1.5.1-1.el7sat |
| Red Hat satellite 6.3 | katello-common | 0:3.4.5-15.el7sat |
| Red Hat satellite 6.3 | katello-debug | 0:3.4.5-15.el7sat |
| Red Hat satellite 6.3 | katello-installer-base | 0:3.4.5.26-1.el7sat |
| Red Hat satellite 6.3 | katello-selinux | 0:3.0.2-1.el7sat |
| Red Hat satellite 6.3 | katello-service | 0:3.4.5-15.el7sat |
| Red Hat satellite 6.3 | kobo | 0:0.5.1-1.el7sat |
| Red Hat satellite 6.3 | pulp | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | pulp-admin-client | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | pulp-docker | 0:2.4.1-2.el7sat |
| Red Hat satellite 6.3 | pulp-docker-admin-extensions | 0:2.4.1-2.el7sat |
| Red Hat satellite 6.3 | pulp-docker-plugins | 0:2.4.1-2.el7sat |
| Red Hat satellite 6.3 | pulp-katello | 0:1.0.2-1.el7sat |
| Red Hat satellite 6.3 | pulp-ostree | 0:1.2.1.1-1.el7sat |
| Red Hat satellite 6.3 | pulp-ostree-admin-extensions | 0:1.2.1.1-1.el7sat |
| Red Hat satellite 6.3 | pulp-ostree-plugins | 0:1.2.1.1-1.el7sat |
| Red Hat satellite 6.3 | pulp-puppet | 0:2.13.4-3.el7sat |
| Red Hat satellite 6.3 | pulp-puppet-admin-extensions | 0:2.13.4-3.el7sat |
| Red Hat satellite 6.3 | pulp-puppet-plugins | 0:2.13.4-3.el7sat |
| Red Hat satellite 6.3 | pulp-puppet-tools | 0:2.13.4-3.el7sat |
| Red Hat satellite 6.3 | pulp-rpm | 0:2.13.4.8-1.el7sat |
| Red Hat satellite 6.3 | pulp-rpm-admin-extensions | 0:2.13.4.8-1.el7sat |
| Red Hat satellite 6.3 | pulp-rpm-plugins | 0:2.13.4.8-1.el7sat |
| Red Hat satellite 6.3 | pulp-selinux | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | pulp-server | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | puppet-foreman_scap_client | 0:0.3.16-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-bindings | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-client-lib | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-common | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-docker-common | 0:2.4.1-2.el7sat |
| Red Hat satellite 6.3 | python-pulp-oid_validation | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-ostree-common | 0:1.2.1.1-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-puppet-common | 0:2.13.4-3.el7sat |
| Red Hat satellite 6.3 | python-pulp-repoauth | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-rpm-common | 0:2.13.4.8-1.el7sat |
| Red Hat satellite 6.3 | python-pulp-streamer | 0:2.13.4.6-1.el7sat |
| Red Hat satellite 6.3 | python-zope-interface | 0:4.0.5-4.el7 |
| Red Hat satellite 6.3 | python-zope-interface-debuginfo | 0:4.0.5-4.el7 |
| Red Hat satellite 6.3 | redhat-access-insights-puppet | 0:0.0.9-2.el7sat |
| Red Hat satellite 6.3 | rubygem-foreman_scap_client | 0:0.3.0-2.el7sat |
| Red Hat satellite 6.3 | rubygem-kafo | 0:2.0.2-1.el7sat |
| Red Hat satellite 6.3 | rubygem-kafo_parsers | 0:0.1.6-1.el7sat |
| Red Hat satellite 6.3 | rubygem-kafo_wizards | 0:0.0.1-2.el7sat |
| Red Hat satellite 6.3 | rubygem-smart_proxy_dhcp_remote_isc | 0:0.0.2.1-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | rubygem-smart_proxy_discovery | 0:1.0.4-3.el7sat |
| Red Hat satellite 6.3 | rubygem-smart_proxy_discovery_image | 0:1.0.9-1.el7sat |
| Red Hat satellite 6.3 | rubygem-smart_proxy_dynflow | 0:0.1.10-1.el7sat |
| Red Hat satellite 6.3 | rubygem-smart_proxy_openscap | 0:0.6.9-1.el7sat |
| Red Hat satellite 6.3 | rubygem-smart_proxy_pulp | 0:1.3.0-1.git.0.b5c2768.el7sat |
| Red Hat satellite 6.3 | rubygem-smart_proxy_remote_execution_ssh | 0:0.1.6-1.el7sat |
| Red Hat satellite 6.3 | rubygem-tilt | 0:1.3.7-2.git.0.3b416c9.el7sat |
| Red Hat satellite 6.3 | satellite | 0:6.3.0-23.0.el7sat |
| Red Hat satellite 6.3 | satellite-capsule | 0:6.3.0-23.0.el7sat |
| Red Hat satellite 6.3 | satellite-cli | 0:6.3.0-23.0.el7sat |
| Red Hat satellite 6.3 | satellite-common | 0:6.3.0-23.0.el7sat |
| Red Hat satellite 6.3 | satellite-debug-tools | 0:6.3.0-23.0.el7sat |
| Red Hat satellite 6.3 | satellite-installer | 0:6.3.0.12-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-bastion | 0:5.1.1.4-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman-redhat_access | 0:2.0.13-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman-tasks | 0:0.9.6.4-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman-tasks-core | 0:0.1.8-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_bootdisk | 0:10.0.2.2-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_discovery | 0:9.1.5.3-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_docker | 0:3.1.0.3-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_hooks | 0:0.3.14-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_openscap | 0:0.7.11-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_remote_execution | 0:1.3.7.2-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_remote_execution_core | 0:1.0.6-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_templates | 0:5.0.1-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_theme_satellite | 0:1.0.4.16-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-foreman_virt_who_configure | 0:0.1.9-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli | 0:0.11.0.1-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_csv | 0:2.3.0-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman | 0:0.11.0.5-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_admin | 0:0.0.8-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_bootdisk | 0:0.1.3.3-2.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_discovery | 0:1.0.0-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_docker | 0:0.0.6-2.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_openscap | 0:0.1.5-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_remote_execution | 0:0.0.6-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_tasks | 0:0.0.12-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_foreman_virt_who_configure | 0:0.0.3-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-hammer_cli_katello | 0:0.11.3.5-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-katello | 0:3.4.5.58-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-katello_ostree | 0:3.4.5.58-1.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-ovirt_provision_plugin | 0:1.0.2-1.fm1_15.el7sat |
| Red Hat satellite 6.3 | tfm-rubygem-smart_proxy_dynflow_core | 0:0.1.10-1.fm1_15.el7sat |
| Red Hat satellite capsule 6.3 | foreman | 0:1.15.6.34-1.el7sat |
| Red Hat satellite capsule 6.3 | foreman-bootloaders-redhat | 0:201801241201-2.el7sat |
| Red Hat satellite capsule 6.3 | foreman-bootloaders-redhat-tftpboot | 0:201801241201-2.el7sat |
| Red Hat satellite capsule 6.3 | foreman-debug | 0:1.15.6.34-1.el7sat |
| Red Hat satellite capsule 6.3 | foreman-discovery-image | 1:3.4.4-1.el7sat |
| Red Hat satellite capsule 6.3 | foreman-installer | 1:1.15.6.8-1.el7sat |
| Red Hat satellite capsule 6.3 | foreman-installer-katello | 0:3.4.5.26-1.el7sat |
| Red Hat satellite capsule 6.3 | foreman-proxy | 0:1.15.6.4-1.el7sat |
| Red Hat satellite capsule 6.3 | foreman-proxy-content | 0:3.4.5-15.el7sat |
| Red Hat satellite capsule 6.3 | foreman-selinux | 0:1.15.6.2-1.el7sat |
| Red Hat satellite capsule 6.3 | hiera | 0:1.3.1-2.el7sat |
| Red Hat satellite capsule 6.3 | katello | 0:3.4.5-15.el7sat |
| Red Hat satellite capsule 6.3 | katello-certs-tools | 0:2.4.0-1.el7sat |
| Red Hat satellite capsule 6.3 | katello-client-bootstrap | 0:1.5.1-1.el7sat |
| Red Hat satellite capsule 6.3 | katello-debug | 0:3.4.5-15.el7sat |
| Red Hat satellite capsule 6.3 | katello-installer-base | 0:3.4.5.26-1.el7sat |
| Red Hat satellite capsule 6.3 | katello-selinux | 0:3.0.2-1.el7sat |
| Red Hat satellite capsule 6.3 | katello-service | 0:3.4.5-15.el7sat |
| Red Hat satellite capsule 6.3 | kobo | 0:0.5.1-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-admin-client | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-docker | 0:2.4.1-2.el7sat |
| Red Hat satellite capsule 6.3 | pulp-docker-admin-extensions | 0:2.4.1-2.el7sat |
| Red Hat satellite capsule 6.3 | pulp-docker-plugins | 0:2.4.1-2.el7sat |
| Red Hat satellite capsule 6.3 | pulp-katello | 0:1.0.2-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-nodes-child | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-nodes-common | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-nodes-parent | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-ostree | 0:1.2.1.1-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-ostree-admin-extensions | 0:1.2.1.1-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-ostree-plugins | 0:1.2.1.1-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-puppet | 0:2.13.4-3.el7sat |
| Red Hat satellite capsule 6.3 | pulp-puppet-admin-extensions | 0:2.13.4-3.el7sat |
| Red Hat satellite capsule 6.3 | pulp-puppet-plugins | 0:2.13.4-3.el7sat |
| Red Hat satellite capsule 6.3 | pulp-rpm | 0:2.13.4.8-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-rpm-admin-extensions | 0:2.13.4.8-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-rpm-plugins | 0:2.13.4.8-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-selinux | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | pulp-server | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | puppet-foreman_scap_client | 0:0.3.16-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-agent-lib | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-bindings | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-client-lib | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-common | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-docker-common | 0:2.4.1-2.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-oid_validation | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-ostree-common | 0:1.2.1.1-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-puppet-common | 0:2.13.4-3.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-repoauth | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-rpm-common | 0:2.13.4.8-1.el7sat |
| Red Hat satellite capsule 6.3 | python-pulp-streamer | 0:2.13.4.6-1.el7sat |
| Red Hat satellite capsule 6.3 | python-zope-interface | 0:4.0.5-4.el7 |
| Red Hat satellite capsule 6.3 | python-zope-interface-debuginfo | 0:4.0.5-4.el7 |
| Red Hat satellite capsule 6.3 | redhat-access-insights-puppet | 0:0.0.9-2.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-kafo | 0:2.0.2-1.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-kafo_parsers | 0:0.1.6-1.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-kafo_wizards | 0:0.0.1-2.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_dhcp_remote_isc | 0:0.0.2.1-1.fm1_15.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_discovery | 0:1.0.4-3.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_discovery_image | 0:1.0.9-1.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_dynflow | 0:0.1.10-1.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_openscap | 0:0.6.9-1.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_pulp | 0:1.3.0-1.git.0.b5c2768.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-smart_proxy_remote_execution_ssh | 0:0.1.6-1.el7sat |
| Red Hat satellite capsule 6.3 | rubygem-tilt | 0:1.3.7-2.git.0.3b416c9.el7sat |
| Red Hat satellite capsule 6.3 | satellite | 0:6.3.0-23.0.el7sat |
| Red Hat satellite capsule 6.3 | satellite-capsule | 0:6.3.0-23.0.el7sat |
| Red Hat satellite capsule 6.3 | satellite-common | 0:6.3.0-23.0.el7sat |
| Red Hat satellite capsule 6.3 | satellite-debug-tools | 0:6.3.0-23.0.el7sat |
| Red Hat satellite capsule 6.3 | satellite-installer | 0:6.3.0.12-1.el7sat |
| Red Hat satellite capsule 6.3 | tfm-rubygem-foreman-tasks-core | 0:0.1.8-1.fm1_15.el7sat |
| Red Hat satellite capsule 6.3 | tfm-rubygem-foreman_remote_execution_core | 0:1.0.6-1.fm1_15.el7sat |
| Red Hat satellite capsule 6.3 | tfm-rubygem-smart_proxy_dynflow_core | 0:0.1.10-1.fm1_15.el7sat |
| SUSE Linux Enterprise Desktop 12 SP2 | puppet | 3.8.5-15.3.3 |
| SUSE Linux Enterprise Desktop 12 SP3 | puppet | 3.8.5-15.3.3 |
| SUSE Linux Enterprise Module for Advanced Systems Management 12 | puppet | 3.8.5-15.3.3 |
| SUSE Linux Enterprise Server 11 SP4 | puppet | 2.7.26-0.5.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | puppet | 2.7.26-0.5.3.1 |
| Ubuntu 14.04 LTS | puppet | 3.4.3-1ubuntu1.2 |
| Ubuntu Pro 16.04 LTS | puppet | 3.8.5-2ubuntu0.1+esm1 |