VulnerabilityModified

CVE-2017-2292

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server.

CRITICAL 9.0EPSS 2.18%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (2.18%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.

CVSS 3.0: 9.0 CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
EPSS: 2.18% probability · 81th percentile
CISA KEV: Not listed
Weakness: CWE-502
Affected: puppet/mcollective
Source: security@puppet.com

References

https://puppet.com/security/cve/cve-2017-2292Vendor Advisory
https://security.gentoo.org/glsa/201709-01
https://puppet.com/security/cve/cve-2017-2292Vendor Advisory
https://security.gentoo.org/glsa/201709-01

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.