{"id":"CVE-2013-3567","aliases":["DEBIAN-CVE-2013-3567","DSA-2715-1","EUVD-2017-0224","GHSA-f7p5-w2cr-7cp7","MGASA-2013-0187","RHSA-2013:1283","RHSA-2013:1284","SUSE-RU-2015:0696-1","openSUSE-SU-2024:10581-1"],"status":"published","title":"Puppet Improper Input Validation vulnerability","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03408,"percentile":0.88959,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-06-26T00:00:00Z","modified":"2026-08-04T06:03:45Z","fixes":[{"ecosystem":"RubyGems","package":"puppet","fixed_in":["2.7.22","3.2.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:11","package":"puppet","fixed_in":["3.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"puppet","fixed_in":["2.6.2-5+squeeze8"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"puppet","fixed_in":["2.7.18-5"],"sources":["osv"]},{"ecosystem":"Mageia:2","package":"puppet","fixed_in":["2.7.22-1.mga2"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"puppet","fixed_in":["2.7.22-1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"puppet3","fixed_in":["3.2.2-1.mga3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.22"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-5+squeeze8"}]}],"versions":["2.6.2-4","2.6.2-5","2.6.2-5+squeeze1","2.6.2-5+squeeze3","2.6.2-5+squeeze4","2.6.2-5+squeeze5","2.6.2-5+squeeze6","2.6.2-5+squeeze7"]},{"source":"osv","ecosystem":"Debian:7","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-5"}]}],"versions":["2.7.18-4"]},{"source":"osv","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.22"}]}],"versions":["2.7.1","2.7.11","2.7.12","2.7.13","2.7.14","2.7.16","2.7.17","2.7.18","2.7.19","2.7.20","2.7.20.rc1","2.7.21","2.7.3","2.7.4","2.7.5","2.7.6","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.2"}]}],"versions":["3.2.1","3.2.1.rc1"]},{"source":"osv","ecosystem":"Mageia:2","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.22-1.mga2"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.22-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"puppet3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-1.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"facter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"hiera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.4-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"puppet-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.4-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-augeas-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-13.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-shadow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-13.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby193-puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-11.1.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby193-puppet-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-11.1.el6ost"}]}],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"novell","product":"suse_linux_enterprise_desktop"},{"vendor":"novell","product":"suse_linux_enterprise_server"},{"vendor":"puppet","product":"puppet"},{"vendor":"puppet","product":"puppet_enterprise"},{"vendor":"puppetlabs","product":"puppet"}],"references":[{"url":"http://secunia.com/advisories/54429","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2013/dsa-2715","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.ubuntu.com/usn/USN-1886-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://puppetlabs.com/security/cve/cve-2013-3567/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1284.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1283.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3567","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-3567.yml","tags":["web"]},{"url":"https://www.puppet.com/security/cve/cve-2013-3567-unauthenticated-remote-code-execution-vulnerability","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f7p5-w2cr-7cp7"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-3567","tags":["advisory"]},{"url":"https://github.com/puppetlabs/puppet","tags":["package"]},{"url":"https://puppetlabs.com/security/cve/cve-2013-3567","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2013-0187.html","tags":["advisory"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-3567/","tags":["web","article"]},{"url":"http://www.ubuntu.com/usn/usn-1886-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1283","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996856","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1283.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3567","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3567","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4761","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4761","tags":["advisory"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4761/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4956","tags":["advisory"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4956/","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1284","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-3567","tags":["article"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4761","tags":["article"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4956","tags":["article"]},{"url":"https://access.redhat.com/support/offerings/techpreview/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1284.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150696-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/825878","tags":["report"]},{"url":"https://bugzilla.suse.com/835122","tags":["report"]},{"url":"https://bugzilla.suse.com/835848","tags":["report"]},{"url":"https://bugzilla.suse.com/835891","tags":["report"]},{"url":"https://bugzilla.suse.com/853982","tags":["report"]},{"url":"https://bugzilla.suse.com/856843","tags":["report"]},{"url":"https://bugzilla.suse.com/864082","tags":["report"]},{"url":"https://bugzilla.suse.com/879913","tags":["report"]},{"url":"https://bugzilla.suse.com/913078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3250","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3253","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-3567","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","status":"published","published":"2013-08-19T23:00:00Z","modified":"2024-08-06T16:14:56.276Z","updated_at":"2026-11-02T14:34:56.530545Z"}],"euvd":[{"id":"EUVD-2017-0224","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","status":"published","published":"2013-08-19T23:00:00Z","modified":"2024-08-06T16:14:56Z","updated_at":"2026-11-03T01:56:34.623989Z"}],"ghsa":[{"id":"GHSA-f7p5-w2cr-7cp7","title":"Puppet Improper Input Validation vulnerability","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-11-10T05:02:53Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:19.438667Z"}],"nvd":[{"id":"CVE-2013-3567","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","status":"published","published":"2013-08-19T23:55:08.523Z","modified":"2026-06-16T23:55:24.883Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-3567","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","status":"published","published":"2013-08-19T23:55:08Z","modified":"2026-04-16T04:32:23.228003189Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-3567","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","status":"published","published":"2013-08-19T23:55:08.523Z","modified":"2026-08-04T06:03:45.497352866Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"DSA-2715-1","title":"puppet - code execution","status":"published","published":"2013-06-26T00:00:00Z","modified":"2026-03-09T01:18:47.382786Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-f7p5-w2cr-7cp7","title":"Puppet Improper Input Validation vulnerability","description":"Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-11-29T05:36:23.437616Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"MGASA-2013-0187","title":"Updated puppet packages fix remote code execution vulnerability","description":"When making REST api calls, the puppet master takes YAML from an untrusted\nclient, deserializes it, and then calls methods on the resulting object.\nA YAML payload can be crafted to cause the deserialization to construct\nan instance of any class available in the ruby process, which allows an\nattacker to execute code contained in the payload.\n","status":"published","published":"2013-06-26T18:36:33Z","modified":"2026-04-16T04:43:12.556153704Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10581-1","title":"ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:42.396541Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2013:1283","title":"Red Hat Security Advisory: puppet security update","status":"published","published":"2024-09-15T21:06:08Z","modified":"2026-06-28T10:08:34Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1284","title":"Red Hat Security Advisory: ruby193-puppet security update","status":"published","published":"2024-09-15T21:06:13Z","modified":"2026-06-28T10:08:35Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-RU-2015:0696-1","title":"Security update for puppet","description":"\nPuppet was updated to fix the following security issues:\n\n    * Unsafe use of temporary files. (CVE-2013-4969)\n    * Arbitrary code execution with required social engineering.\n      (CVE-2014-3248, CVE-2014-3250)\n\nSecurity Issues references:\n\n    * CVE-2014-3248\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248\u003e\n    * CVE-2013-4969\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969\u003e\n    * CVE-2014-3250\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250\u003e\n\n","status":"published","published":"2014-06-30T15:48:55Z","modified":"2026-02-04T02:49:05.925899Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}