Critical Puppet and OpenVox Flaws Expose Servers to Code Execution and Client Impersonation

Vox Pupuli disclosed critical vulnerabilities affecting Puppet and OpenVox in an advisory covering all known versions. Two findings reported by a Neodyme researcher concern server-side remote code execution and client impersonation. The code-execution flaw involves processing agent reports: events associated with custom resource types can contain serialized Ruby objects, and a maliciously constructed object can execute code when the server deserializes it. Neodyme also published research on the Puppet RCE.

The impersonation flaw affects the shared trapperkeeper-authorization library used by Trapperkeeper-based applications. Its authorization logic handles plain-string and wildcard identity matches through the same mechanism, creating a client-impersonation risk. Vox Pupuli also reported a separate critical vulnerability in container-openvoxdb, although the supplied excerpt does not describe its mechanism or impact. Organizations using these components should prioritize reviewing the full advisories, identifying affected deployments, and applying the prescribed remediation; the supplied material does not establish fixed versions or exploitation in the wild.