CVE-2017-2295

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Puppet	Puppet server	Puppet prior to 4.10.1

References

http://www.debian.org/security/2017/dsa-3862Third Party Advisory
http://www.securityfocus.com/bid/98582Third Party Advisory, VDB Entry
https://puppet.com/security/cve/cve-2017-2295Vendor Advisory
http://www.debian.org/security/2017/dsa-3862Third Party Advisory
http://www.securityfocus.com/bid/98582Third Party Advisory, VDB Entry
https://puppet.com/security/cve/cve-2017-2295Vendor Advisory

Timeline

Published: Jul 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-22966.5In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group na CVE-2017-22977.5Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users before returning labeled RBAC access tokens. CVE-2017-22986.5The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written.CVE-2017-22997.5Versions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify CVE-2017-23007.5On Juniper Networks SRX Series Services Gateways chassis clusters running Junos OS 12.1X46 prior to 12.1X46-D65, 12.3X48 prior to 12.3X48-D4 CVE-2017-23017.5On Juniper Networks products or platforms running Junos OS 11.4 prior to 11.4R13-S3, 12.1X46 prior to 12.1X46-D60, 12.3 prior to 12.3R12-S2 CVE-2017-23027.5On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D55, 12.1X47 prior to 12.1X47-D45, 12.3R13 prior to 12.3 CVE-2017-23037.5On Juniper Networks products or platforms running Junos OS 12.1X46 prior to 12.1X46-D50, 12.1X47 prior to 12.1X47-D40, 12.3 prior to 12.3R13 CVE-2017-23047.5Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300 and EX4600 devices running Junos OS 14.1X53 prior to 14.1X53-D40, 15.1X53 prior CVE-2017-23058.8On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space admi CVE-2017-23068.8On Juniper Networks Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the Junos Space admi CVE-2017-23076.1A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may