CVE-2013-1655: Puppet

High severity, CVSS 7.5. EPSS: 4.6% chance of exploitation in the next 30 days.

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."

Affected products

• Puppet Puppet: version 2.7.2 only; version 2.7.3 only; version 2.7.4 only; version 2.7.5 only; version 2.7.6 only; version 2.7.7 only; …
• Puppet Puppet Enterprise: version 3.1.0 only
• Puppetlabs Puppet: version 2.7.0 only; version 2.7.1 only; version 2.7.19 only; version 2.7.20 only

Published 2013-03-20. Last modified 2026-06-16.