CVE-2013-3567

Name of the Vulnerable Software and Affected Versions Puppet versions 2.7.x prior to 2.7.23 Puppet versions 3.2.x prior to 3.2.2 Puppet Enterprise versions prior to 2.8.2

Description The issue allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call, potentially leading to a breach of confidentiality, integrity, and availability of protected information. This can be exploited by an authenticated attacker.

Recommendations For Puppet versions 2.7.x prior to 2.7.23, update to version 2.7.23 or later. For Puppet versions 3.2.x prior to 3.2.2, update to version 3.2.2 or later. For Puppet Enterprise versions prior to 2.8.2, update to version 2.8.2 or later.