CVE-2017-2292 - MCollective Remote Code Execution Via YAML Deserialization

Overview

MCollective Remote Code Execution Via YAML Deserialization

  • Posted May 11, 2017

  • Assessed Risk Level: Critical

  • CVSS: 9.0

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.

This vulnerability was found by an internal audit at Puppet.

Status:

Affected Software Versions:

  • Puppet Enterprise prior to 2016.4.5
  • Puppet Enterprise 2016.5.x
  • Puppet Enterprise 2017.1.x
  • Puppet Agent prior to 1.10.1

Resolved in:

  • Puppet Enterprise 2016.4.5
  • Puppet Enterprise 2017.2.1
  • Puppet Agent 1.10.1