Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4804-1 advisory.

  - In previous versions of Puppet Agent it was possible to install a module with world writable permissions.
    Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability. (CVE-2017-10689)

  - Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in     this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe     manner, which would lead to remote code execution. This change constrains the format of data on the wire     to PSON or safely decoded YAML. (CVE-2017-2295)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities :

  - A remote command execution vulnerability exists in the MCollective plugin     due to unsafe YAML deserialization. An unauthenticated, remote attacker     can exploit this to bypass authentication and execute arbitrary commands.     (CVE-2017-2292, CVE-2017-2295)

  - An arbitrary package install vulnerability exists in the MCollective plugin     due to unsafe default configuration. An unauthenticated, remote attacker     can exploit this to install or remove packages on all managed agents.
    (CVE-2017-2293)

  - An information disclosure vulnerability exists in the MCollective plugin     due to unsafe storage of server private keys. An unauthenticated, remote attacker     can exploit this to view sensitive private keys.
    (CVE-2017-2294)   
  - An authentication bypass vulnerability exists in labled RBAC access tokens.     An unauthenticated, attacker can exploit this, to bypass authentication     and execute arbitrary actions of users configured to use labeled RBAC     access tokens. This issue has been fixed in Puppet Enterprise 2016.4.5     and 2017.2.1. This only affects users with labeled tokens, which is     not the default for tokens. (CVE-2017-2297)

This update for puppet fixes the following issues :

  - CVE-2017-2295: Fixed a security vulnerability where an     attacker could force YAML deserialization in an unsafe     manner, which would lead to remote code execution. In     default, this update would break a backwards     compatibility with Puppet agents older than 3.2.2 as the     SLE11 master doesn't support other fact formats than     pson in default anymore. In order to allow users to     continue using their SLE11 agents a patch was added that     enables sending PSON from agents. For non-SUSE clients     older that 3.2.2 a new puppet master boolean option     'dangerous_fact_formats' was added. When it's set to     true it enables using dangerous fact formats (e.g.
    YAML). When it's set to false, only PSON fact format is     accepted. (bsc#1040151), (bsc#1077767)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0336 advisory.

  - rubygem-will_paginate: XSS vulnerabilities (CVE-2013-6459)

  - foreman: models with a 'belongs_to' association to an Organization do not verify association belongs to     that Organization (CVE-2014-8183)

  - V8: integer overflow leading to buffer overflow in Zone::New (CVE-2016-1669)

  - foreman: inspect in a provisioning template exposes sensitive controller information (CVE-2016-3693)

  - pulp: Leakage of CA key in pulp-qpid-ssl-cfg (CVE-2016-3696)

  - pulp: Unsafe use of bash $RANDOM for NSS DB password and seed (CVE-2016-3704)

  - foreman: privilege escalation through Organization and Locations API (CVE-2016-4451)

  - foreman: Information disclosure in provisioning template previews (CVE-2016-4995)

  - foreman: inside discovery-debug, the root password is displayed in plaintext (CVE-2016-4996)

  - foreman: Persistent XSS in Foreman remote execution plugin (CVE-2016-6319)

  - foreman: Foreman information leak through unauthorized multiple_checkboxes helper (CVE-2016-7077)

  - foreman: Information leak through organizations and locations feature (CVE-2016-7078)

  - foreman: Stored XSS vulnerability in remote execution plugin (CVE-2016-8613)

  - foreman: Stored XSS in org/loc wizard (CVE-2016-8634)

  - foreman: Stored XSS via organization/location with HTML in name (CVE-2016-8639)

  - foreman-debug: missing obfuscation of sensitive information (CVE-2016-9593)

  - katello-debug: Possible symlink attacks due to use of predictable file names (CVE-2016-9595)

  - puppet: Unsafe YAML deserialization (CVE-2017-2295)

  - rubygem-hammer_cli: no verification of API server's SSL certificate (CVE-2017-2667)

  - foreman: Image password leak (CVE-2017-2672)

  - Interconnect: Denial of Service vulnerability in Red Hat JBoss AMQ Interconnect (CVE-2017-15699)

  - katello: SQL inject in errata-related REST API (CVE-2018-14623)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for puppet fixes the following issues: Security issue fixed :

  - CVE-2017-2295: Possible code execution vulnerability     where an attacker could force YAML deserialization in an     unsafe manner. In default, this update breaks a     backwards compatibility with Puppet agents older than     3.2.2 as the SLE12 master doesn't support other fact     formats than pson in default anymore. In order to allow     users to continue using their SLE12 master/SLE11 agents     setup and fix CVE-2017-2295 for the others, a new puppet     master boolean option 'dangerous_fact_formats' was     added. When it's set to true it enables using dangerous     fact formats (e.g. YAML). When it's set to false, only     PSON fact format is accepted. (bsc#1040151)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-puppet fixes the following issues :

  - CVE-2017-2295: A remote attacker could have forced     unsafe YAML deserialization which could have led to code     execution (bsc#1040151)

Contains fixes to ensure Puppet can start correctly and a security fix for remote code execution tracked as [CVE-2017-2295](https://bugzilla.redhat.com/show_bug.cgi?id=1452654).

  - Fix remote code execution in Puppet master during fact     uploads - Fedora#1452654

  - Fix SSL monkey patches error on startup - Fedora#1440710     , Fedora#1443673

  - Fix xmlrpc/client require error on startup -     Fedora#1443673

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution.

For Debian 7 'Wheezy', these problems have been fixed in version 2.7.23-1~deb7u4, by enabling PSON serialization on clients and refusing non-PSON formats on the server.

We recommend that you upgrade your puppet packages. Make sure you update all your clients before you update the server otherwise older clients won't be able to connect to the server.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Unsafe YAML deserialization :

Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner, which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML. (CVE-2017-2295 )

Dennis Rowe discovered that Puppet incorrectly handled the search path. A local attacker could use this issue to possibly execute arbitrary code. (CVE-2014-3248)

It was discovered that Puppet incorrectly handled YAML deserialization. A remote attacker could possibly use this issue to execute arbitrary code on the master. This update is incompatible with agents older than 3.2.2. (CVE-2017-2295).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2017-2295 and fix for using systemd service provider in a chroot.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that unrestricted YAML deserialisation of data sent from agents to the server in the Puppet configuration management system could result in the execution of arbitrary code.

Note that this fix breaks backward compability with Puppet agents older than 3.2.2 and there is no safe way to restore it. This affects puppet agents running on Debian wheezy; we recommend to update to the puppet version shipped in wheezy-backports.

ID	Name	Product	Family	Severity
183709	Ubuntu 16.04 ESM : Puppet vulnerabilities (USN-4804-1)	Nessus	Ubuntu Local Security Checks	high
129755	Puppet Enterprise < 2016.4.5 / 2016.5.x / 2017.1.x Multiple Vulnerabilities	Nessus	CGI abuses	critical
107139	SUSE SLES11 Security Update : puppet (SUSE-SU-2018:0600-1)	Nessus	SuSE Local Security Checks	high
107053	RHEL 7 : Satellite 6.3 (RHSA-2018:0336)	Nessus	Red Hat Local Security Checks	high
102352	SUSE SLED12 Security Update : puppet (SUSE-SU-2017:2113-1)	Nessus	SuSE Local Security Checks	high
101969	openSUSE Security Update : rubygem-puppet (openSUSE-2017-835)	Nessus	SuSE Local Security Checks	high
101710	Fedora 26 : puppet (2017-b9b66117bb)	Nessus	Fedora Local Security Checks	high
101211	Debian DLA-1012-1 : puppet security update	Nessus	Debian Local Security Checks	high
101002	Amazon Linux AMI : puppet3 (ALAS-2017-849)	Nessus	Amazon Linux Local Security Checks	high
100632	Ubuntu 14.04 LTS : Puppet vulnerabilities (USN-3308-1)	Nessus	Ubuntu Local Security Checks	high
100564	Fedora 25 : puppet (2017-8ad8d1bd86)	Nessus	Fedora Local Security Checks	high
100432	Debian DSA-3862-1 : puppet - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-2295

high

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high