CVE Vulnerabilities

CVE-2017-2292

Deserialization of Untrusted Data

Published: Jun 30, 2017 | Modified: Apr 20, 2025
CVSS 3.x
9
CRITICAL
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
8.1 IMPORTANT
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Ubuntu
MEDIUM

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, but there is a chance that third-party plugins could rely on this insecure behavior.

Weakness

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected Software

Name Vendor Start Version End Version
Mcollective Puppet * 2.10.3 (including)
Mcollective Ubuntu artful *
Mcollective Ubuntu bionic *
Mcollective Ubuntu esm-apps/bionic *
Mcollective Ubuntu esm-apps/xenial *
Mcollective Ubuntu trusty *
Mcollective Ubuntu upstream *
Mcollective Ubuntu xenial *
Mcollective Ubuntu yakkety *
Mcollective Ubuntu zesty *

Potential Mitigations

  • Make fields transient to protect them from deserialization.
  • An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.

References