GCVE-110-MAGEIA-2013-187

Advisory Published

Vulnetix · Advisory published June 26, 2013

When making REST api calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be crafted to cause the deserialization to construct an instance of any class available in the ruby process, which allows an attacker to execute code contained in the payload.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
Mageia	puppet	0 (affected), 2.7.22-1.mga2 (unaffected)	—
Mageia	puppet	0 (affected), 2.7.22-1.mga3 (unaffected)	—
Mageia	puppet3	0 (affected), 3.2.2-1.mga3 (unaffected)	—

References

Updated puppet packages fix remote code execution vulnerability

advisory

Updated puppet packages fix remote code execution vulnerability

issue

Updated puppet packages fix remote code execution vulnerability

advisory

Browse GCVE Records

75,294 records in the GCVE database · Updated July 30, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON