< back to search

gpp_maybe Security update for puppet
SUSE-SLE-Module-Adv-Systems-Management-12-2017-1310

This update for puppet fixes the following issues: Security issue fixed: - CVE-2017-2295: Possible code execution vulnerability where an attacker could force YAML deserialization in an unsafe manner. In default, this update breaks a backwards compatibility with Puppet agents older than 3.2.2 as the SLE12 master doesn't support other fact formats than pson in default anymore. In order to allow users to continue using their SLE12 master/SLE11 agents setup and fix CVE-2017-2295 for the others, a new puppet master boolean option "dangerous_fact_formats" was added. When it's set to true it enables using dangerous fact formats (e.g. YAML). When it's set to false, only PSON fact format is accepted. (bsc#1040151)

  • Release Date
    Aug 9 2017
  • References
    Bugzilla: 1040151
    CVEs: CVE-2017-2295
  • Type
    security
  • Severity
    important

cloud_download Downloads

Advanced Systems Management Module 12 ppc64le
  • Packages
    puppet
    A network tool for managing many disparate systems
    3.8.5-15.3.3 lock rpm lock src
    puppet-server
    A network tool for managing many disparate systems
    3.8.5-15.3.3 lock rpm
Advanced Systems Management Module 12 x86_64
  • Packages
    puppet
    A network tool for managing many disparate systems
    3.8.5-15.3.3 lock rpm lock src
    puppet-server
    A network tool for managing many disparate systems
    3.8.5-15.3.3 lock rpm
Advanced Systems Management Module 12 s390x
  • Packages
    puppet
    A network tool for managing many disparate systems
    3.8.5-15.3.3 lock rpm lock src
    puppet-server
    A network tool for managing many disparate systems
    3.8.5-15.3.3 lock rpm