Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.1340
puppet security update
26 May 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: puppet
Publisher: Debian
Operating System: Debian GNU/Linux 8
Linux variants
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-2295
Original Bulletin:
http://www.debian.org/security/2017/dsa-3862
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running puppet check for an updated version of the software for
their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3862-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 25, 2017 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : puppet
CVE ID : CVE-2017-2295
It was discovered that unrestricted YAML deserialisation of data sent
from agents to the server in the Puppet configuration management system
could result in the execution of arbitrary code.
Note that this fix breaks backward compability with Puppet agents older
than 3.2.2 and there is no safe way to restore it. This affects puppet
agents running on Debian wheezy; we recommend to update the the
puppet version shipped in wheezy-backports.
For the stable distribution (jessie), this problem has been fixed in
version 3.7.2-4+deb8u1.
For the unstable distribution (sid), this problem has been fixed in
version 4.8.2-5.
We recommend that you upgrade your puppet packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAlknTOYACgkQEMKTtsN8
Tjab6Q/9Hg3bGxJsSdjY7M7G5081AOeRM0rbBpT2jnepqvYAO5/p6Iyk/a0v05ZN
THyCrFblJcsTpzNOzjT12BLfBlt+ItSuP0xEZutPst5K4ukkumi4Db62abqyvsa9
no75nnnfx55PjeGjDVaTtnCoFzpaodrRRjiTvHQDD7+L9p2Z/3FvuXEoOsgH/iEj
moSu9C4zsIVR+Rie6wr5X/JyUYQ4a0r5ufY+uIPHrv9KQR19vUdVaM3tB0sxLhex
prfJH/EnNNuvRg08DAkeMNjxuR3xj9/h7MrAUFvTm4wOOG7qLVkHtgNjG231WTgZ
UWMsWtEgewtg86pfVhd1+gsCBN4rxLSu+S9uHwpJ0fLywoVxhg0crvF7Ty31tn7k
I7noBzMSGtN+XK8gokLaDF/dtEVjnICDICD8LH05fS08aqaCu2is3usp9CHCb1uP
JriNjVnxfppsf1p5VEU1TanTfyxLrvPaTPyw7tVx2KKQnsBfN8dYiC2qMM3XMr27
ZRjhlpDRW7IEExmQ2pJgFNEaNk0f3lBG0dV53hdX7mY8+TZ7gif8wfUJqAqt3+pD
s0hasSljPsir7Mfc4f40c3pTNohVIGSe7x028hh+5j6VV4GmAvBChTr+JgywWdS+
lOykq0J8zlztzffKqNrEPPPU72FVq+xYhEF2dYvxDEEbqKIkewE=
=v0sH
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWSdgJox+lLeg9Ub1AQhZRg//d5SV2V8xArRga8AWycrYkx+5aHJCGFQ4
7sHROheqyuZT+KfNUEPSINYbVfPEYT35hiQKw4g957yMnCh1v0U/UsC1X4jlLfU5
BtLV2ENW6qD3qvDr9vaG529D9MROOy+pvsuP2tDOPu9sTRRMF4Gt7RT6DtDBxJ7U
A31EIulWRA9rYDEiEtemAQ305J5lgZ/sKONoShGe48e6ARXJyQb3ixoShe7ZYeHl
02qv6lg0VmnQdZTzO+4S/mW3n4ICTNa8Wnz44v4We9x5i6YnZlgnURFaApN7b9VU
vlzwKVcq0BP1AHWIX57hiTV+mQgedxt7fwtHCGwCAeLmWbaWxNWYZl6TCy2vXlV1
2K9QuYadhmLt9fyEaxHdG97J4LN9T37Yx9kprjzLSLF6UGwXqsuq2R726uObM2I4
S8GOuFqaq1z2ZFGDXYfdnogTUEH1hE/JQaXnRWG8hFStwwIJDaUjR9iD9WcqTsfs
/vzIHncc9CC7H6q9YxO8giEuYMRWwGJje5/S4ES3B8fqn72HpErncKlOfl+VgnUq
8An3pJyVOKPrSGyL/N+OOvcGec30amNSGoHJiegQptfar2sYqL3njtoIWULxLGag
FC+WKh47XrVBkuv0o//yB4xxtRW4pga12V5PyHePjAO72zuM4+3/fXhoH8047kYT
1hoDV7c/WhQ=
=yXO2
-----END PGP SIGNATURE-----