CVE catalog

CVE-2013-3567

puppet - code execution

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
3.41% · Oct 25, 2026

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpuppet113.2.2-1fixed
Debianpuppet6.02.6.2-4vulnerable
Debianpuppet6.02.6.2-5vulnerable
Debianpuppet6.02.6.2-5+squeeze1vulnerable
Debianpuppet6.02.6.2-5+squeeze3vulnerable
Debianpuppet6.02.6.2-5+squeeze4vulnerable
Debianpuppet6.02.6.2-5+squeeze5vulnerable
Debianpuppet6.02.6.2-5+squeeze6vulnerable
Debianpuppet6.02.6.2-5+squeeze7vulnerable
Debianpuppet6.02.6.2-5+squeeze8fixed
Debianpuppet72.7.18-4vulnerable
Debianpuppet72.7.18-5fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpuppetdeb113.2.2-1Not reportedDEBIAN-CVE-2013-3567Not reported
Debianpuppetdeb6.02.6.2-5+squeeze8Not reportedDSA-2715-1Not reported
Debianpuppetdeb72.7.18-5Not reportedDSA-2715-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]