Debian DSA-3862-1 : puppet - security update

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-3862. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(100432);
  script_version("3.11");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/17");

  script_cve_id("CVE-2017-2295");
  script_xref(name:"DSA", value:"3862");

  script_name(english:"Debian DSA-3862-1 : puppet - security update");

  script_set_attribute(attribute:"synopsis", value:
"The remote Debian host is missing a security-related update.");
  script_set_attribute(attribute:"description", value:
"It was discovered that unrestricted YAML deserialisation of data sent
from agents to the server in the Puppet configuration management
system could result in the execution of arbitrary code.

Note that this fix breaks backward compability with Puppet agents
older than 3.2.2 and there is no safe way to restore it. This affects
puppet agents running on Debian wheezy; we recommend to update to the
puppet version shipped in wheezy-backports.");
  script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/jessie/puppet");
  script_set_attribute(attribute:"see_also", value:"https://www.debian.org/security/2017/dsa-3862");
  script_set_attribute(attribute:"solution", value:
"Upgrade the puppet packages.

For the stable distribution (jessie), this problem has been fixed in
version 3.7.2-4+deb8u1.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-2295");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"patch_publication_date", value:"2017/05/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/05/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:puppet");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Debian Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2017-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"8.0", prefix:"puppet", reference:"3.7.2-4+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"puppet-common", reference:"3.7.2-4+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"puppet-el", reference:"3.7.2-4+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"puppet-testsuite", reference:"3.7.2-4+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"puppetmaster", reference:"3.7.2-4+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"puppetmaster-common", reference:"3.7.2-4+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"puppetmaster-passenger", reference:"3.7.2-4+deb8u1")) flag++;
if (deb_check(release:"8.0", prefix:"vim-puppet", reference:"3.7.2-4+deb8u1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");