{"id":"CVE-2013-4761","aliases":["DEBIAN-CVE-2013-4761","DSA-2761-1","EUVD-2017-0218","GHSA-cj43-9h3w-v976","MGASA-2013-0259","RHSA-2013:1283","RHSA-2013:1284","SUSE-RU-2015:0696-1","openSUSE-SU-2024:10581-1"],"status":"published","title":"Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","severity":{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01643,"percentile":0.76587,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2013-08-20T22:00:00Z","modified":"2026-08-04T06:03:37Z","fixes":[{"ecosystem":"RubyGems","package":"puppet","fixed_in":["2.7.23","3.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:11","package":"puppet","fixed_in":["3.2.4-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.23"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.4"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.23-1~deb7u1"}]}],"versions":["2.7.18-4","2.7.18-5"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.23"}]}],"versions":["2.7.1","2.7.11","2.7.12","2.7.13","2.7.14","2.7.16","2.7.17","2.7.18","2.7.19","2.7.20","2.7.20.rc1","2.7.21","2.7.22","2.7.3","2.7.4","2.7.5","2.7.6","2.7.8","2.7.9"]},{"source":"osv","ecosystem":"RubyGems","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.4"}]}],"versions":["3.2.1","3.2.1.rc1","3.2.2","3.2.3","3.2.3.rc1"]},{"source":"osv","ecosystem":"Mageia:2","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.23-1.mga2"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.23-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"puppet3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"facter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.6-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"hiera","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-3.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.4-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"puppet-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.4-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-augeas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-augeas-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-shadow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-13.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby-shadow-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.1-13.el6_4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby193-puppet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-11.1.el6ost"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:3::el6","package":"ruby193-puppet-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.1-11.1.el6ost"}]}],"bundled":3}],"products":[{"vendor":"puppet","product":"puppet"},{"vendor":"puppet","product":"puppet_enterprise"},{"vendor":"puppetlabs","product":"puppet"}],"references":[{"url":"http://www.debian.org/security/2013/dsa-2761","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4761/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1284.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1283.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4761","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2013-4761.yml","tags":["web"]},{"url":"https://www.puppet.com/security/cve/cve-2013-4761-resourcetype-remote-code-execution-vulnerability","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cj43-9h3w-v976"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4761","tags":["advisory"]},{"url":"https://github.com/puppetlabs/puppet","tags":["package"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4761","tags":["web","article"]},{"url":"https://advisories.mageia.org/MGASA-2013-0259.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11019","tags":["report"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4956/","tags":["web","article"]},{"url":"http://www.ubuntu.com/usn/usn-1928-1/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1283","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=996856","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1283.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-3567","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-3567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3567","tags":["advisory"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-3567/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4761","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4761","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4956","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4956","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1284","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-3567","tags":["article"]},{"url":"http://puppetlabs.com/security/cve/cve-2013-4956","tags":["article"]},{"url":"https://access.redhat.com/support/offerings/techpreview/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1284.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150696-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/825878","tags":["report"]},{"url":"https://bugzilla.suse.com/835122","tags":["report"]},{"url":"https://bugzilla.suse.com/835848","tags":["report"]},{"url":"https://bugzilla.suse.com/835891","tags":["report"]},{"url":"https://bugzilla.suse.com/853982","tags":["report"]},{"url":"https://bugzilla.suse.com/856843","tags":["report"]},{"url":"https://bugzilla.suse.com/864082","tags":["report"]},{"url":"https://bugzilla.suse.com/879913","tags":["report"]},{"url":"https://bugzilla.suse.com/913078","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-3567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3250","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3253","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4761","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T16:52:26.979Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2017-0218","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","status":"published","published":"2013-08-20T22:00:00Z","modified":"2024-08-06T16:52:26Z","updated_at":"2026-11-03T01:56:31.067159Z"}],"ghsa":[{"id":"GHSA-cj43-9h3w-v976","title":"Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-11-10T05:02:53Z","updated_at":"2026-11-02T14:37:19.438667Z"}],"nvd":[{"id":"CVE-2013-4761","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","status":"published","published":"2013-08-20T22:55:04.297Z","modified":"2026-06-16T23:57:51.24Z","cvss":[{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:35.248411Z"}],"osv":[{"id":"CVE-2013-4761","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","status":"published","published":"2013-08-20T22:55:04Z","modified":"2026-04-16T06:16:33.360257869Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4761","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","status":"published","published":"2013-08-20T22:55:04.297Z","modified":"2026-08-04T06:03:37.266502923Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2761-1","title":"puppet - several","status":"published","published":"2013-09-19T00:00:00Z","modified":"2026-03-09T01:20:34.881871Z","updated_at":"2026-11-02T15:46:15.489951Z"},{"id":"GHSA-cj43-9h3w-v976","title":"Puppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service","description":"Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified \"local file system access\" to the Puppet Master.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-11-29T05:36:41.183107Z","updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"MGASA-2013-0259","title":"Updated puppet and puppet3 package fix security vulnerabilities","description":"It was discovered that Puppet incorrectly handled the resource_type\nservice. A local attacker on the master could use this issue to execute\narbitrary Ruby files (CVE-2013-4761).\n\nIt was discovered that Puppet incorrectly handled permissions on the\nmodules it installed. Modules could be installed with the permissions\nthat existed when they were built, possibly exposing them to a local\nattacker (CVE-2013-4956).\n","status":"published","published":"2013-08-26T19:44:50Z","modified":"2026-04-16T06:26:13.602920498Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10581-1","title":"ruby2.2-rubygem-puppet-3.8.7-2.2 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-puppet-3.8.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:42.396541Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2013:1283","title":"Red Hat Security Advisory: puppet security update","status":"published","published":"2024-09-15T21:06:08Z","modified":"2026-06-28T10:08:34Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"RHSA-2013:1284","title":"Red Hat Security Advisory: ruby193-puppet security update","status":"published","published":"2024-09-15T21:06:13Z","modified":"2026-06-28T10:08:35Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-RU-2015:0696-1","title":"Security update for puppet","description":"\nPuppet was updated to fix the following security issues:\n\n    * Unsafe use of temporary files. (CVE-2013-4969)\n    * Arbitrary code execution with required social engineering.\n      (CVE-2014-3248, CVE-2014-3250)\n\nSecurity Issues references:\n\n    * CVE-2014-3248\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3248\u003e\n    * CVE-2013-4969\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4969\u003e\n    * CVE-2014-3250\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3250\u003e\n\n","status":"published","published":"2014-06-30T15:48:55Z","modified":"2026-02-04T02:49:05.925899Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}