CVE-2013-1655
Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
Exploit likelihood
What each source reports
NVD Score used
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
- Record
CVE-2013-1655- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
- Record
CVE-2013-1655- Updated
- 2026-11-02
EUVDEUVD-2017-0168 No score
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
- Record
EUVD-2017-0168- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-574q-fxfj-wv6h No score
Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
- Record
GHSA-574q-fxfj-wv6h- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
- Record
CVE-2013-1655- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1655 No score
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
- Record
DEBIAN-CVE-2013-1655- Updated
- 2026-11-02
OSVGHSA-574q-fxfj-wv6h No score
Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
- Record
GHSA-574q-fxfj-wv6h- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetRubyGems |
3.1.0 up to 3.1.1 | 3.1.1 |
puppetRubyGems |
2.7.0 up to 2.7.21 | 2.7.21 |
puppetDebian:11 |
before 2.7.18-3 | 2.7.18-3 |
puppetDebian:6.0 From an advisory covering 7 CVEs |
before 2.6.2-5+squeeze7, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze42.6.2-5+squeeze52.6.2-5+squeeze6 |
2.6.2-5+squeeze7 |
puppetRubyGems |
2.7.0 up to 2.7.21, plus listed versions 2.7.12.7.112.7.122.7.132.7.14 Show 12 moreShow less2.7.162.7.172.7.182.7.192.7.202.7.20.rc12.7.32.7.42.7.52.7.62.7.82.7.9 |
2.7.21 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1655 is a high vulnerability (CVSS 7.5) in Puppet, published March 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.56%, the 91st percentile. Fixed in puppet 3.1.1.
References
securityfocus.com/bid/58442
lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html
debian.org/security/2013/dsa-2643
secunia.com/advisories/52596
puppetlabs.com/security/cve/cve-2013-1655
ubuntu.com/usn/usn-1759-1
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-1655
github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-1655.yml
web.archive.org/web/20200228144801/http://www.securityfocus.com/bid/58442
puppet.com/security/cve/cve-2013-1655-unauthenticated-remote-code-execution-vulnerability
security-tracker.debian.org/tracker/CVE-2013-1655