High severity8.2NVD Advisory· Published Jul 5, 2017· Updated May 13, 2026
CVE-2017-2295
CVE-2017-2295
Description
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.
Affected products
3- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- Puppet/Puppet serverv5Range: Puppet prior to 4.10.1
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.debian.org/security/2017/dsa-3862nvdThird Party Advisory
- www.securityfocus.com/bid/98582nvdThird Party AdvisoryVDB Entry
- puppet.com/security/cve/cve-2017-2295nvdVendor Advisory
News mentions
0No linked articles in our index yet.