Puppet Enterprise Dashboard report YAML Processing Vulnerability

Release date:
Updated on:

Affected Systems:
Puppet Labs Puppet Enterprise <3.0.1
Description:
--------------------------------------------------------------------------------
CVE (CAN) ID: CVE-2013-4957

Puppet is an IT automation software that helps the system administrator manage the infrastructure.

Before Puppet Enterprise 3.1.0, an error occurs when processing specific types of reports. Special YAML code can cause arbitrary code execution.

<* Source: vendor

Link: http://secunia.com/advisories/55362/
Http://puppetlabs.com/security/cve/cve-2013-4957
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Puppet Labs
-----------
Puppet Labs has released a Security Bulletin (cve-2013-4957) and patches for this:
Cve-2013-4957: CVE-2013-4957 (Puppet Dashboard Report YAML Handling Vulnerability)
Link: http://puppetlabs.com/security/cve/cve-2013-4957

Recommended reading:

Research on three Backup Recovery solutions for Puppet agent
Register your Puppet node in a safer way
Deep understanding of Puppet syntax and working mechanism through SSH Configuration
Puppet uses Nginx multiple ports for Load Balancing
C/S mode instance of Puppet in CentOS (5 and 6)

For more information about Puppet, click here.
Puppet: click here