PT-2017-15331 · Puppet · Mcollective

Publicado 2017-06-30 · Atualizado 2017-09-06 · CVE-2017-2292

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions MCollective versions prior to 2.10.4

Description The issue allows for potential arbitrary code execution on the server due to the deserialization of YAML from agents without using safe load. This could be exploited if an attacker sends maliciously crafted YAML input.

Recommendations For versions prior to 2.10.4, update to version 2.10.4 or later to ensure that YAML input is handled securely using YAML.safe load. As a temporary workaround, consider modifying the affected code to use YAML.safe load on input from agents.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2017-2292

Produtos afetados

Mcollective

Referências · 10

• https://github.com/puppetlabs/marionette-collective/commit/e0e741889f5adeb8f75387037106b0d28a9099b0 · Nota
• https://osv.dev/vulnerability/CVE-2017-2292 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-2292 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2292 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-2292 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2292 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-2292 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-2292 · Nota de Segurança
• https://security.gentoo.org/glsa/201709-01 · Aviso do Fabricante
• https://puppet.com/security/cve/cve-2017-2292 · Aviso do Fabricante