Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Moses Mendoza (moses) reports:
CVE-2013-1640 - Remote code execution on master from authenticated clients
* Affected versions: 0.24.7 and greater
* Resolved in Puppet 2.6.18, 2.7.21, 3.1.1, Puppet Enterprise 1.2.7, 2.7.2
A bug in Puppet allows an authenticated client to request its catalog
from the puppet master, and cause the puppet master to execute
arbitrary code. The puppet master must invoke with the `template` or
`inline_template` functions during catalog compilation for this to be
exploited.
External References:
https://puppetlabs.com/security/cve/cve-2013-1640/