exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2013-0710-01

Posted Apr 5, 2013

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0710-01 - Puppet allows provisioning, patching, and configuration of clients to be managed and automated. A flaw was found in how Puppet handled certain HTTP PUT requests. An attacker with valid authentication credentials, and authorized to save to the authenticated client's own report, could construct a malicious request that could possibly cause the Puppet master to execute arbitrary code. A flaw was found in how Puppet handled the "template" and "inline_template" functions during catalog compilation. If an authenticated attacker were to requests its catalog from the Puppet master, it could possibly result in arbitrary code execution when the catalog is compiled.

tags | advisory, web, arbitrary, code execution

systems | linux, redhat

advisories | CVE-2012-6120, CVE-2013-1640, CVE-2013-1652, CVE-2013-1654, CVE-2013-2274, CVE-2013-2275

SHA-256 | 287e00cc1e326aec1722ac557fce76b5e0388b5683cb3624788e846953353c44

Download | Favorite | View

Related Files

No related files