puppet: remote code execution on master from unauthenticated clients

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

Amazon Linux AMI : perl-YAML-LibYAML (ALAS-2012-69)

Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML aka YAML-LibYAML and perl-YAML-LibYAML module 0.38 for Perl allow remote attackers to cause a denial of service process crash via format string specifiers in a 1 YAML stream to the Load function, 2 YA...

puppet: security fix for YAML support (critical)

A potential remote code execution via YAML was fixed in puppet. CVE-2013-3567...

[SECURITY] Fedora 19 Update: php-symfony2-Validator-2.2.5-1.fc19

This component is based on the JSR-303 Bean Validation specification and enables specifying validation rules for classes using XML, YAML, PHP or annotations, which can then be checked against instances of these classes. Optional dependencies: APC, DoctrineCommon...

[SECURITY] Fedora 18 Update: php-symfony2-Validator-2.2.5-1.fc18

This component is based on the JSR-303 Bean Validation specification and enables specifying validation rules for classes using XML, YAML, PHP or annotations, which can then be checked against instances of these classes. Optional dependencies: APC, DoctrineCommon...

CVE-2013-3567

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

DEBIAN-CVE-2013-3567

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

CVE-2013-3567

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

Improper access control

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

CVE-2013-3567

Summary: CVE-2013-3567 affects Puppet 2.7.x < 2.7.22, 3.2.x < 3.2.2, and Puppet Enterprise = 2.7.22 for 2.7.x, >= 3.2.2 for 3.2.x, or >= 2.8.2 for Puppet Enterprise.

CVE-2013-3567

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

CVE-2013-3567: Improper Input Validation

Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call...

Squash YAML Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'zlib' class Metasploit3 'Squash YAML Code...

Squash YAML Code Execution

This module exploits a remote code execution vulnerability in the YAML request processor of the Squash application. Module Options msf use exploit/unix/webapp/squash/yamlexec msf undefinedyamlexec show actions ...actions... msf undefinedyamlexec set ACTION msf undefinedyamlexec show options ...sh...

Critical: puppet

Issue Overview: Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call. Affected Packages: puppet Issue Correctio...

puppet code exeuction

Code execution via YAML object deserialization...

Debian DSA-2715-1 : puppet - code execution

It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially crafted payload to execute arbitrary code on the puppet master. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text a...

CVE-2013-4660

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...

Code injection

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...

CVE-2013-4660

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation...