Debian/puppet: high 8.2
Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server, in this case) with a attacker-specified format. This could be used to force YAML deserialization in
Action: Upgrade puppet to 4.8.2-5 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.8.2-5 | - |
Fixed versions
| 4.8.2-5 |
Sources
published · modified · JSON