CVE-2013-1655

Published: Mar 20, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

Affected (22)

Products: Puppet: Puppet, Puppet Enterprise · Puppetlabs: Puppet

2 products

1 product

Configuration A

22 vulnerable · 13 platform

Vulnerable Software	Affected Versions
Puppet Puppet	Version 2.7.10
Puppet Puppet	Version 2.7.11
Puppet Puppet	Version 2.7.12
Puppet Puppet	Version 2.7.13
Puppet Puppet	Version 2.7.14
Puppet Puppet	Version 2.7.16
Puppet Puppet	Version 2.7.17
Puppet Puppet	Version 2.7.18
Puppet Puppet	Version 2.7.2
Puppet Puppet	Version 2.7.3
Puppet Puppet	Version 2.7.4
Puppet Puppet	Version 2.7.5
Puppet Puppet	Version 2.7.6
Puppet Puppet	Version 2.7.7
Puppet Puppet	Version 2.7.8
Puppet Puppet	Version 2.7.9
Puppet Puppet Enterprise	Version 3.1.0
Puppetlabs Puppet	Version 2.7.0
Puppetlabs Puppet	Version 2.7.19
Puppetlabs Puppet	Version 2.7.1
Puppetlabs Puppet	Version 2.7.20
Puppetlabs Puppet	Version 2.7.20 rc1

Running on/with	Platform Versions
Ruby Lang Ruby	Version 1.9.1
Ruby Lang Ruby	Version 1.9.2
Ruby Lang Ruby	Version 1.9.3
Ruby Lang Ruby	Version 1.9.3 p0
Ruby Lang Ruby	Version 1.9.3 p125
Ruby Lang Ruby	Version 1.9.3 p194
Ruby Lang Ruby	Version 1.9.3 p286
Ruby Lang Ruby	Version 1.9.3 p383
Ruby Lang Ruby	Version 1.9
Ruby Lang Ruby	Version 2.0.0
Ruby Lang Ruby	Version 2.0.0 rc1
Ruby Lang Ruby	Version 2.0.0 rc2
Ruby Lang Ruby	Version 2.0