SUSE-SU-2017:2113-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2113-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2017:2113-1
Related
Published
2017-08-09T07:43:44Z
Modified
2017-08-09T07:43:44Z
Summary
Security update for puppet
Details

This update for puppet fixes the following issues:

Security issue fixed: - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as the SLE12 master doesn't support other fact formats than pson in default anymore. In order to allow users to continue using their SLE12 master/SLE11 agents setup and fix CVE-2017-2295 for the others, a new puppet master boolean option 'dangerousfactformats' was added. When it's set to true it enables using dangerous fact formats (e.g. YAML). When it's set to false, only PSON fact format is accepted. (bsc#1040151)

References

Affected packages

SUSE:Linux Enterprise Desktop 12 SP2 / puppet

Package

Name
puppet
Purl
purl:rpm/suse/puppet&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.8.5-15.3.3

Ecosystem specific 

{
    "binaries": [
        {
            "puppet": "3.8.5-15.3.3"
        }
    ]
}

SUSE:Linux Enterprise Desktop 12 SP3 / puppet

Package

Name
puppet
Purl
purl:rpm/suse/puppet&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.8.5-15.3.3

Ecosystem specific 

{
    "binaries": [
        {
            "puppet": "3.8.5-15.3.3"
        }
    ]
}

SUSE:Linux Enterprise Module for Advanced Systems Management 12 / puppet

Package

Name
puppet
Purl
purl:rpm/suse/puppet&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Advanced%20Systems%20Management%2012

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.8.5-15.3.3

Ecosystem specific 

{
    "binaries": [
        {
            "puppet": "3.8.5-15.3.3",
            "puppet-server": "3.8.5-15.3.3"
        }
    ]
}