File _patchinfo of Package patchinfo.5194

Overview Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo.5194

<patchinfo incident="5194">
  <issue id="1040151" tracker="bnc">VUL-0: CVE-2017-2295 puppet: Unsafe YAML deserialization allowing for RCE</issue>
  <issue id="2017-2295" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>kstreitova</packager>
  <description>This update for puppet fixes the following issues:

Security issue fixed:
- CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML
  deserialization in an unsafe manner. In default, this update breaks a backwards compatibility
  with Puppet agents older than 3.2.2 as the SLE12 master doesn't support other fact formats than
  pson in default anymore.
  In order to allow users to continue using their SLE12 master/SLE11 agents setup and fix
  CVE-2017-2295 for the others, a new puppet master boolean option "dangerous_fact_formats" was
  added. When it's set to true it enables using dangerous fact formats (e.g. YAML). When it's set
  to false, only PSON fact format is accepted. (bsc#1040151)
</description>
  <summary>Security update for puppet</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo.5194

Places