High severityNVD Advisory· Published Aug 19, 2013· Updated Jun 16, 2026
CVE-2013-3567
CVE-2013-3567
Description
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
puppetRubyGems | >= 2.7.0, < 2.7.22 | 2.7.22 |
puppetRubyGems | >= 3.2.0, < 3.2.2 | 3.2.2 |
Affected products
42cpe:2.3:a:puppetlabs:puppet:1.0.0:-:enterprise:*:*:*:*:*+ 24 more
- cpe:2.3:a:puppetlabs:puppet:1.0.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:1.1.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:1.2.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.5.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.6.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.19:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.1:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.20:*:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.20:rc1:*:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:2.7.2:-:enterprise:*:*:*:*:*
- cpe:2.3:a:puppetlabs:puppet:3.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.10:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.11:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.12:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.13:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.14:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.16:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.17:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.18:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:2.7.21:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*+ 7 more
- cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*range: <=2.8.1
- cpe:2.3:a:puppet:puppet_enterprise:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:puppet:puppet_enterprise:2.8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp2:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:novell:suse_linux_enterprise_desktop:11.0:sp2:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp2:*:*:*:vmware:*:*+ 2 more
- cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp2:*:*:*:vmware:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:*:*:*
- cpe:2.3:o:novell:suse_linux_enterprise_server:11.0:sp3:*:*:*:vmware:*:*
Patches
Vulnerability mechanics
References
13- secunia.com/advisories/54429nvdVendor Advisory
- github.com/advisories/GHSA-f7p5-w2cr-7cp7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-3567ghsaADVISORY
- puppetlabs.com/security/cve/cve-2013-3567/nvdVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.htmlnvdWEB
- lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2013-1283.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2013-1284.htmlnvdWEB
- www.debian.org/security/2013/dsa-2715nvdWEB
- www.ubuntu.com/usn/USN-1886-1nvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-3567.ymlghsaWEB
- puppetlabs.com/security/cve/cve-2013-3567ghsaWEB
- www.puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerabilityghsaWEB
News mentions
0No linked articles in our index yet.