High severityNVD Advisory· Published Aug 19, 2013· Updated Apr 29, 2026
CVE-2013-3567
CVE-2013-3567
Description
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
puppetRubyGems | >= 2.7.0, < 2.7.22 | 2.7.22 |
puppetRubyGems | >= 3.2.0, < 3.2.2 | 3.2.2 |
Affected products
41cpe:2.3:a:puppetlabs:puppet:1.0.0:-:enterprise:*:*:*:*:*+ 13 more
- cpe:2.3:a:puppetlabs:puppet:1.0.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:1.1.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:1.2.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.6.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.1:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.2:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.21:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*range: <=2.8.1
- cpe:2.3:a:puppet:puppet_enterprise:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp2:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp2:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp2:*:*:*:vmware:*:*+ 2 more
- cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp2:*:*:*:vmware:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:vmware:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
13- secunia.com/advisories/54429nvdVendor Advisory
- github.com/advisories/GHSA-f7p5-w2cr-7cp7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-3567ghsaADVISORY
- puppetlabs.com/security/cve/cve-2013-3567/nvdVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.htmlnvdWEB
- lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2013-1283.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2013-1284.htmlnvdWEB
- www.debian.org/security/2013/dsa-2715nvdWEB
- www.ubuntu.com/usn/USN-1886-1nvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-3567.ymlghsaWEB
- puppetlabs.com/security/cve/cve-2013-3567ghsaWEB
- www.puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerabilityghsaWEB
News mentions
0No linked articles in our index yet.