[ GLSA 201709-01 ] MCollective

[GLSA]

Gentoo Linux Security Advisory

Title: MCollective: Remote Code Execution (GLSA 201709-01)
Severity: normal
Exploitable: remote
Date: 2017-09-04
Bug(s): #624704
ID: 201709-01

Synopsis

A vulnerability in MCollective might allow remote attackers to
execute arbitrary code.


Background

MCollective is a framework to build server orchestration or parallel job
execution systems.


Affected Packages

Package: app-admin/mcollective
Vulnerable: < 2.11.0
Unaffected: >= 2.11.0
Architectures: All supported architectures


Description

A vulnerability was discovered in MCollective which allowed for
deserialized YAML from agents without calling safe_load. This allows the
potential for arbitrary code execution on the server.


Impact

A remote attacker could possibly execute arbitrary code with the
privileges of the process or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All MCollective users should upgrade to the latest version: