Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - puppet: incorrect URL decoding (CVE-2016-2785)

  - The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck     directive, which might allow remote attackers to obtain sensitive information via a revoked certificate     when a Puppet master runs with Apache 2.4. (CVE-2014-3250)

  - The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC     padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-     oracle attack, aka the POODLE issue. (CVE-2014-3566)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4804-1 advisory.

    It was discovered that Puppet installed modules with world writable permissions. An attacker could use     this vulnerability to execute arbitrary code or cause a denial of service. (CVE-2017-10689)

    It was discovered that Puppet could be used to force YAML deserialization in an unsafe manner. A remote     attacker could use this vulnerability for remote code execution. (CVE-2017-2295)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities :

  - A remote command execution vulnerability exists in the MCollective plugin     due to unsafe YAML deserialization. An unauthenticated, remote attacker     can exploit this to bypass authentication and execute arbitrary commands.     (CVE-2017-2292, CVE-2017-2295)

  - An arbitrary package install vulnerability exists in the MCollective plugin     due to unsafe default configuration. An unauthenticated, remote attacker     can exploit this to install or remove packages on all managed agents.
    (CVE-2017-2293)

  - An information disclosure vulnerability exists in the MCollective plugin     due to unsafe storage of server private keys. An unauthenticated, remote attacker     can exploit this to view sensitive private keys.
    (CVE-2017-2294)   
  - An authentication bypass vulnerability exists in labled RBAC access tokens.     An unauthenticated, attacker can exploit this, to bypass authentication     and execute arbitrary actions of users configured to use labeled RBAC     access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5     and 2017.2.1. This only affects users with labeled tokens, which is     not the default for tokens. (CVE-2017-2297)

This update for puppet fixes the following issues :

  - CVE-2017-2295: Fixed a security vulnerability where an     attacker could force YAML deserialization in an unsafe     manner, which would lead to remote code execution. In     default, this update would break a backwards     compatibility with Puppet agents older than 3.2.2 as the     SLE11 master doesn't support other fact formats than     pson in default anymore. In order to allow users to     continue using their SLE11 agents a patch was added that     enables sending PSON from agents. For non-SUSE clients     older that 3.2.2 a new puppet master boolean option     'dangerous_fact_formats' was added. When it's set to     true it enables using dangerous fact formats (e.g.
    YAML). When it's set to false, only PSON fact format is     accepted. (bsc#1040151), (bsc#1077767)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0336 advisory.

    Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning,     remote management, and monitoring of multiple Linux deployments with a single centralized tool.

    This update provides Satellite 6.3 packages for Red Hat Enterprise Linux 7 Satellite server. For the full     list of new features provided by Satellite 6.3, see the Release Notes linked to in the references section.
    See the Satellite 6 Installation Guide for detailed instructions on how to install a new Satellite 6.3     environment, or the Satellite 6 Upgrading and Updating guide for detailed instructions on how to upgrade     from prior versions of Satellite 6.

    All users who require Satellite version 6.3 are advised to install these new packages.

    Security Fix(es):

    * V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)

    * rubygem-will_paginate: XSS vulnerabilities (CVE-2013-6459)

    * foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to     that Organization (CVE-2014-8183)

    * foreman: inspect in a provisioning template exposes sensitive controller information (CVE-2016-3693)

    * pulp: Unsafe use of bash $RANDOM for NSS DB password and seed (CVE-2016-3704)

    * foreman: privilege escalation through Organization and Locations API (CVE-2016-4451)

    * foreman: inside discovery-debug, the root password is displayed in plaintext (CVE-2016-4996)

    * foreman: Persistent XSS in Foreman remote execution plugin (CVE-2016-6319)

    * foreman: Stored XSS via organization/location with HTML in name (CVE-2016-8639)

    * katello-debug: Possible symlink attacks due to use of predictable file names (CVE-2016-9595)

    * rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)

    * foreman: Image password leak (CVE-2017-2672)

    * pulp: Leakage of CA key in pulp-qpid-ssl-cfg (CVE-2016-3696)

    * foreman: Information disclosure in provisioning template previews (CVE-2016-4995)

    * foreman-debug: missing obfuscation of sensitive information (CVE-2016-9593)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Randy Barlow (RedHat) for reporting CVE-2016-3704 and Sander Bos for reporting     CVE-2016-3696. The CVE-2014-8183 issue was discovered by Eric Helms (Red Hat); the CVE-2016-3693 and     CVE-2016-4995 issues were discovered by Dominic Cleal (Red Hat); the CVE-2016-4451 and CVE-2016-6319     issues were discovered by Marek Huln (Red Hat); the CVE-2016-4996 issue was discovered by Thom Carlin     (Red Hat); the CVE-2016-8639 issue was discovered by Sanket Jagtap (Red Hat); the CVE-2016-9595 issue was     discovered by Evgeni Golov (Red Hat); the CVE-2017-2667 issue was discovered by Tomas Strachota (Red Hat);
    and the CVE-2016-9593 issue was discovered by Pavel Moravec (Red Hat).

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for puppet fixes the following issues: Security issue fixed :

  - CVE-2017-2295: Possible code execution vulnerability     where an attacker could force YAML deserialization in an     unsafe manner. In default, this update breaks a     backwards compatibility with Puppet agents older than     3.2.2 as the SLE12 master doesn't support other fact     formats than pson in default anymore. In order to allow     users to continue using their SLE12 master/SLE11 agents     setup and fix CVE-2017-2295 for the others, a new puppet     master boolean option 'dangerous_fact_formats' was     added. When it's set to true it enables using dangerous     fact formats (e.g. YAML). When it's set to false, only     PSON fact format is accepted. (bsc#1040151)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-puppet fixes the following issues :

  - CVE-2017-2295: A remote attacker could have forced     unsafe YAML deserialization which could have led to code     execution (bsc#1040151)

Contains fixes to ensure Puppet can start correctly and a security fix for remote code execution tracked as [CVE-2017-2295](https://bugzilla.redhat.com/show_bug.cgi?id=1452654).

  - Fix remote code execution in Puppet master during fact     uploads - Fedora#1452654

  - Fix SSL monkey patches error on startup - Fedora#1440710     , Fedora#1443673

  - Fix xmlrpc/client require error on startup -     Fedora#1443673

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution.

For Debian 7 'Wheezy', these problems have been fixed in version 2.7.23-1~deb7u4, by enabling PSON serialization on clients and refusing non-PSON formats on the server.

We recommend that you upgrade your puppet packages. Make sure you update all your clients before you update the server otherwise older clients won't be able to connect to the server.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unsafe YAML deserialization :

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML. (CVE-2017-2295 )

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3308-1 advisory.

    Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this     issue to possibly execute arbitrary code. (CVE-2014-3248)

    It was discovered that Puppet incorrectly handled YAML deserialization. A remote attacker could possibly     use this issue to execute arbitrary code on the master. This update is incompatible with agents older than     3.2.2. (CVE-2017-2295)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-2295 and fix for using systemd service provider in a chroot.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that unrestricted YAML deserialisation of data sent from agents to the server in the Puppet configuration management system could result in the execution of arbitrary code.

Note that this fix breaks backward compability with Puppet agents older than 3.2.2 and there is no safe way to restore it. This affects puppet agents running on Debian wheezy; we recommend to update to the puppet version shipped in wheezy-backports.

ID	Name	Product	Family	Severity
199619	RHEL 6 : puppet (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
183709	Ubuntu 16.04 ESM : Puppet vulnerabilities (USN-4804-1)	Nessus	Ubuntu Local Security Checks	high
129755	Puppet Enterprise < 2016.4.5 / 2016.5.x / 2017.1.x Multiple Vulnerabilities	Nessus	CGI abuses	critical
107139	SUSE SLES11 Security Update : puppet (SUSE-SU-2018:0600-1)	Nessus	SuSE Local Security Checks	high
107053	RHEL 7 : Satellite 6.3 (RHSA-2018:0336)	Nessus	Red Hat Local Security Checks	high
102352	SUSE SLED12 Security Update : puppet (SUSE-SU-2017:2113-1)	Nessus	SuSE Local Security Checks	high
101969	openSUSE Security Update : rubygem-puppet (openSUSE-2017-835)	Nessus	SuSE Local Security Checks	high
101710	Fedora 26 : puppet (2017-b9b66117bb)	Nessus	Fedora Local Security Checks	high
101211	Debian DLA-1012-1 : puppet security update	Nessus	Debian Local Security Checks	high
101002	Amazon Linux AMI : puppet3 (ALAS-2017-849)	Nessus	Amazon Linux Local Security Checks	high
100632	Ubuntu 14.04 LTS : Puppet vulnerabilities (USN-3308-1)	Nessus	Ubuntu Local Security Checks	high
100564	Fedora 25 : puppet (2017-8ad8d1bd86)	Nessus	Fedora Local Security Checks	high
100432	Debian DSA-3862-1 : puppet - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-2295

high

Tenable Plugins

critical

high

critical

high

high

high

high

high

high

high

high

high

high