CVE-2013-3567
Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Exploit likelihood
What each source reports
NVD Score used
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
- Record
CVE-2013-3567- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
- Record
CVE-2013-3567- Updated
- 2026-11-02
EUVDEUVD-2017-0224 No score
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
- Record
EUVD-2017-0224- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f7p5-w2cr-7cp7 No score
Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
- Record
GHSA-f7p5-w2cr-7cp7- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
- Record
CVE-2013-3567- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-3567 No score
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
- Record
DEBIAN-CVE-2013-3567- Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-f7p5-w2cr-7cp7 No score
Puppet Improper Input Validation vulnerability
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
- Record
GHSA-f7p5-w2cr-7cp7- Weakness
- CWE-20
- Updated
- 2026-11-02
OSVMGASA-2013-0187 No score
Updated puppet packages fix remote code execution vulnerability
When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.
- Record
MGASA-2013-0187- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10581-1 No score
ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media
These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10581-1- Updated
- 2026-11-02
OSVSUSE-RU-2015:0696-1 No score
Security update for puppet
Puppet was updated to fix the following security issues:
* Unsafe use of temporary files. (CVE-2013-4969)
* Arbitrary code execution with required social engineering.
(CVE-2014-3248, CVE-2014-3250)
Security Issues references:
* CVE-2014-3248
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248>
* CVE-2013-4969
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969>
* CVE-2014-3250
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250>
- Record
SUSE-RU-2015:0696-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
puppetRubyGems |
2.7.0 up to 2.7.22 | 2.7.22 |
puppetRubyGems |
3.2.0 up to 3.2.2 | 3.2.2 |
puppetDebian:11 |
before 3.2.2-1 | 3.2.2-1 |
puppetDebian:6.0 |
before 2.6.2-5+squeeze8, plus listed versions 2.6.2-42.6.2-52.6.2-5+squeeze12.6.2-5+squeeze32.6.2-5+squeeze42.6.2-5+squeeze52.6.2-5+squeeze62.6.2-5+squeeze7 |
2.6.2-5+squeeze8 |
puppetDebian:7 |
before 2.7.18-5, plus listed versions 2.7.18-4 |
2.7.18-5 |
puppetRubyGems |
2.7.0 up to 2.7.22, plus listed versions 2.7.12.7.112.7.122.7.132.7.14 Show 13 moreShow less2.7.162.7.172.7.182.7.192.7.202.7.20.rc12.7.212.7.32.7.42.7.52.7.62.7.82.7.9 |
2.7.22 |
puppetRubyGems |
3.2.0 up to 3.2.2, plus listed versions 3.2.13.2.1.rc1 |
3.2.2 |
puppetMageia:2 |
before 2.7.22-1.mga2 | 2.7.22-1.mga2 |
puppetMageia:3 |
before 2.7.22-1.mga3 | 2.7.22-1.mga3 |
puppet3Mageia:3 |
before 3.2.2-1.mga3 | 3.2.2-1.mga3 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
facterRed Hat:openstack:3::el6 |
before 0:1.6.6-1.el6_4 | 0:1.6.6-1.el6_4 |
hieraRed Hat:openstack:3::el6 |
before 0:1.0.0-3.el6_4 | 0:1.0.0-3.el6_4 |
puppetRed Hat:openstack:3::el6 |
before 0:3.2.4-1.el6_4 | 0:3.2.4-1.el6_4 |
puppet-serverRed Hat:openstack:3::el6 |
before 0:3.2.4-1.el6_4 | 0:3.2.4-1.el6_4 |
ruby-augeasRed Hat:openstack:3::el6 |
before 0:0.4.1-1.el6_4 | 0:0.4.1-1.el6_4 |
ruby-augeas-debuginfoRed Hat:openstack:3::el6 |
before 0:0.4.1-1.el6_4 | 0:0.4.1-1.el6_4 |
ruby-shadowRed Hat:openstack:3::el6 |
before 0:1.4.1-13.el6_4 | 0:1.4.1-13.el6_4 |
ruby-shadow-debuginfoRed Hat:openstack:3::el6 |
before 0:1.4.1-13.el6_4 | 0:1.4.1-13.el6_4 |
ruby193-puppetRed Hat:openstack:3::el6 |
before 0:3.1.1-11.1.el6ost | 0:3.1.1-11.1.el6ost |
ruby193-puppet-serverRed Hat:openstack:3::el6 |
before 0:3.1.1-11.1.el6ost | 0:3.1.1-11.1.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-3567 is a high vulnerability (CVSS 7.5) in Puppet, published June 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.41%, the 88th percentile. Fixed in puppet 2.7.22.
References
secunia.com/advisories/54429
lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html
debian.org/security/2013/dsa-2715
ubuntu.com/usn/USN-1886-1
puppetlabs.com/security/cve/cve-2013-3567
Show 52 moreShow less
rhn.redhat.com/errata/RHSA-2013-1284.html
nvd.nist.gov/vuln/detail/CVE-2013-3567
github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-3567.yml
puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerability
security-tracker.debian.org/tracker/CVE-2013-3567
advisories.mageia.org/MGASA-2013-0187.html
access.redhat.com/errata/RHSA-2013:1283
bugzilla.redhat.com/show_bug.cgi?id=974649
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1283.json
cve.org/CVERecord?id=CVE-2013-3567
suse.com/support/update/announcement//suse-ru-20150696-1
bugzilla.suse.com/825878