CVE catalog

CVE-2017-2295

Security update for puppet

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
2.76% · Oct 25, 2026

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpuppet114.8.2-5fixed
Debianpuppet83.7.2-4vulnerable
Debianpuppet83.7.2-4+deb8u1~bpo70+1vulnerable
Debianpuppet83.7.2-4+deb8u1fixed
Debianpuppet72.7.18-4vulnerable
Debianpuppet72.7.18-5vulnerable
Debianpuppet72.7.23-1~deb7u1vulnerable
Debianpuppet72.7.23-1~deb7u2vulnerable
Debianpuppet72.7.23-1~deb7u3vulnerable
Debianpuppet72.7.23-1~deb7u4fixed
Ubuntupuppet14.043.2.4-2ubuntu2vulnerable
Ubuntupuppet14.043.3.1-1ubuntu1vulnerable
Ubuntupuppet14.043.3.1-1ubuntu2vulnerable
Ubuntupuppet14.043.3.1-1ubuntu3vulnerable
Ubuntupuppet14.043.4.2-1vulnerable
Ubuntupuppet14.043.4.3-1vulnerable
Ubuntupuppet14.043.4.3-1ubuntu1vulnerable
Ubuntupuppet14.043.4.3-1ubuntu1.1vulnerable
Ubuntupuppet14.043.4.3-1ubuntu1.2fixed
Ubuntupuppetpro3.7.2-5ubuntu2vulnerable
Ubuntupuppetpro3.8.4-1ubuntu1vulnerable
Ubuntupuppetpro3.8.5-1ubuntu1vulnerable
Ubuntupuppetpro3.8.5-2vulnerable
Ubuntupuppetpro3.8.5-2ubuntu0.1vulnerable
Ubuntupuppetpro3.8.5-2ubuntu0.1+esm1fixed
Susepuppetlinux enterprise desktop 12 sp23.8.5-15.3.3fixed
Susepuppetlinux enterprise desktop 12 sp33.8.5-15.3.3fixed
Susepuppetlinux enterprise module for advanced systems management 123.8.5-15.3.3fixed
Susepuppetlinux enterprise server 11 sp42.7.26-0.5.3.1fixed
Susepuppetlinux enterprise server for sap applications 11 sp42.7.26-0.5.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpuppetdeb114.8.2-5Not reportedDEBIAN-CVE-2017-2295Not reported
Debianpuppetdeb83.7.2-4+deb8u1Not reportedDSA-3862-1Not reported
Debianpuppetdeb72.7.23-1~deb7u4Not reportedDLA-1012-1Not reported
Ubuntupuppetdeb14.043.4.3-1ubuntu1.2Not reportedUBUNTU-CVE-2017-2295Not reported
Ubuntupuppetdebpro3.8.5-2ubuntu0.1+esm1Not reportedUBUNTU-CVE-2017-2295Not reported
Susepuppetrpmlinux enterprise desktop 12 sp23.8.5-15.3.3Not reportedSUSE-SU-2017:2113-1Not reported
Susepuppetrpmlinux enterprise desktop 12 sp33.8.5-15.3.3Not reportedSUSE-SU-2017:2113-1Not reported
Susepuppetrpmlinux enterprise module for advanced systems management 123.8.5-15.3.3Not reportedSUSE-SU-2017:2113-1Not reported
Susepuppetrpmlinux enterprise server 11 sp42.7.26-0.5.3.1Not reportedSUSE-SU-2018:0600-1Not reported
Susepuppetrpmlinux enterprise server for sap applications 11 sp42.7.26-0.5.3.1Not reportedSUSE-SU-2018:0600-1Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]