CVE-2013-1655

EPSS 4.56%
Veröffentlicht 20.03.2013 16:55:01
Zuletzt bearbeitet 29.04.2026 01:13:23
Erkennungen
Login

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 10

NVD 22 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Puppet ≫ Puppet Version 2.7.2

   Ruby-lang ≫ Ruby Version 1.9
   Ruby-lang ≫ Ruby Version 1.9.1
   Ruby-lang ≫ Ruby Version 1.9.2
   Ruby-lang ≫ Ruby Version 1.9.3
   Ruby-lang ≫ Ruby Version 1.9.3 Update p0
   Ruby-lang ≫ Ruby Version 1.9.3 Update p125
   Ruby-lang ≫ Ruby Version 1.9.3 Update p194
   Ruby-lang ≫ Ruby Version 1.9.3 Update p286
   Ruby-lang ≫ Ruby Version 1.9.3 Update p383
   Ruby-lang ≫ Ruby Version 2.0
   Ruby-lang ≫ Ruby Version 2.0.0
   Ruby-lang ≫ Ruby Version 2.0.0 Update rc1
   Ruby-lang ≫ Ruby Version 2.0.0 Update rc2

Puppet ≫ Puppet Version 2.7.3

Puppet ≫ Puppet Version 2.7.4

Puppet ≫ Puppet Version 2.7.5

Puppet ≫ Puppet Version 2.7.6

Puppet ≫ Puppet Version 2.7.7

Puppet ≫ Puppet Version 2.7.8

Puppet ≫ Puppet Version 2.7.9

Puppet ≫ Puppet Version 2.7.10

Puppet ≫ Puppet Version 2.7.11

Puppet ≫ Puppet Version 2.7.12

Puppet ≫ Puppet Version 2.7.13

Puppet ≫ Puppet Version 2.7.14

Puppet ≫ Puppet Version 2.7.16

Puppet ≫ Puppet Version 2.7.17

Puppet ≫ Puppet Version 2.7.18

Puppet ≫ Puppet Enterprise Version 3.1.0

Puppetlabs ≫ Puppet Version 2.7.0

Puppetlabs ≫ Puppet Version 2.7.1

Puppetlabs ≫ Puppet Version 2.7.19

Puppetlabs ≫ Puppet Version 2.7.20

Puppetlabs ≫ Puppet Version 2.7.20 Update rc1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	4.56%	0.904

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html

http://lists.opensuse.org/opensuse-updates/2013-04/msg00056.html

http://secunia.com/advisories/52596

Vendor Advisory

http://ubuntu.com/usn/usn-1759-1

http://www.debian.org/security/2013/dsa-2643

http://www.securityfocus.com/bid/58442

https://puppetlabs.com/security/cve/cve-2013-1655/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2013-1655

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2013-1655

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2013-1655

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2013-1655