CVE-2017-2292
—CVSS 3.0
9.0 critical
EPSS
2%p81
Published
()
Modified
Description
Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.
- Vendors
- puppet
- Products
- mcollective
- Weakness
- CWE-502
- Vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
In the news0 stories
No ingested article mentions this CVE yet.