Lucene search
Veracode Vulnerability DatabaseVERACODE:4509HistoryJul 03, 2017 - 1:13 a.m.
Remote Code Execution (RCE) Through YAML Deserialization
2017-07-0301:13:13
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
0.001 Low
EPSS
Percentile
37.8%
mcollective-client is vulnerable to Remote Code Execution (RCE) Through YAML Deserialization. The library uses the insecure YAML.load method to deserialize yaml files. This can allow a malicious user to inject and execute arbitrary code by sending a yaml file to the system.
| CPE | Name | Operator | Version |
|---|---|---|---|
| mcollective-client | le | 2.10.3 |
Related
osv
osv
CVE-2017-2292
2017-06-30 20:29:00
nvd
nvd
CVE-2017-2292
2017-06-30 20:29:00
redhatcve
redhatcve
CVE-2017-2292
2017-07-12 11:50:01
debiancve
debiancve
CVE-2017-2292
2017-06-30 20:29:00
nessus
nessus
GLSA-201709-01 : MCollective: Remote Code Execution
2017-09-05 00:00:00
Puppet Enterprise < 2016.4.5 / 2016.5.x / 2017.1.x Multiple Vulnerabilities
2019-10-09 00:00:00
gentoo
gentoo
MCollective: Remote Code Execution
2017-09-04 00:00:00
cve
cve
CVE-2017-2292
2017-06-30 20:29:00
prion
prion
Code injection
2017-06-30 20:29:00
ubuntucve
ubuntucve
CVE-2017-2292
2017-06-30 00:00:00
cvelist
cvelist
CVE-2017-2292
2017-05-11 00:00:00
openvas
openvas
Puppet Enterprise < 2016.4.5, 2016.5.x < 2017.2.1 Multiple Vulnerabilities
2017-07-06 00:00:00