Threats tagged 'ghsa-4pxx-8frq-9r4j'

A critical deserialization vulnerability exists in the report-processing code of Puppet Server. An attacker with any CA-signed agent certificate can submit a crafted report to execute arbitrary code on the Puppet Server as its service user. If the certificate authority autosigns requests without strong verification, an unauthenticated network attacker may obtain such a certificate and exploit this flaw.