Debian: DSA-2643-1 Critical Puppet Remote Code Execution Risks

CVE-2013-1640

An authenticated malicious client may request its catalog from the puppet
master, and cause the puppet master to execute arbitrary code. The puppet
master must be made to invoke the `template` or `inline_template` functions
during catalog compilation.

CVE-2013-1652

An authenticated malicious client may retrieve catalogs from the puppet
master that it is not authorized to access. Given a valid certificate and
private key, it is possible to construct an HTTP GET request that will
return a catalog for an arbitrary client.

CVE-2013-1653

An authenticated malicious client may execute arbitrary code on Puppet
agents that accept kick connections. Puppet agents are not vulnerable in
their default configuration. However, if the Puppet agent is configured to
listen for incoming connections, e.g. listen = true, and the agent's
auth.conf allows access to the `run` REST endpoint, then an authenticated
client can construct an HTTP PUT request t...