It was discovered that puppet, a centralized configuration management system, did not correctly handle YAML payloads. A remote attacker could use a specially-crafted payload to execute arbitrary code on the puppet master.

For the oldstable distribution (squeeze), this problem will be fixed in version 2.6.2-5+squeeze8. For the stable distribution (wheezy), this problem has been fixed in version 2.7.18-5. For the testing distribution (jessie), this problem will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 3.2.2-1. We recommend that you upgrade your puppet packages.

This package contains the startup script and compatbility scripts for the puppet agent, which is the process responsible for configuring the local node.

puppet on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2013/dsa-2715.html

---

Updated on 2015-03-25