| Package | Affected versions | Patched versions |
|---|---|---|
| puppet | ≥ 2.7.0, < 2.7.22≥ 3.2.0, < 3.2.2 | 2.7.223.2.2 |
| puppet | = 2.7.10= 2.7.11= 2.7.12= 2.7.13= 2.7.14= 2.7.16= 2.7.17= 2.7.18= 2.7.2= 2.7.21= 3.2.1 | |
| puppet enterprise | = 1.0= 1.1= 1.2.0= 2.0.0= 2.5.1= 2.5.2= 2.8.0≤ 2.8.1 | |
| puppet | = 1.0.0= 1.1.0= 1.2.0= 2.5.0= 2.6.0= 2.7.0= 2.7.1= 2.7.19= 2.7.2= 2.7.20= 3.2.0 |
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free