Joined: 12 May 2004
|Posted: Mon Sep 04, 2017 11:26 pm Post subject: [ GLSA 201709-01 ] MCollective
|Gentoo Linux Security Advisory
Title: MCollective: Remote Code Execution (GLSA 201709-01)
A vulnerability in MCollective might allow remote attackers to
execute arbitrary code.
MCollective is a framework to build server orchestration or parallel job
Vulnerable: < 2.11.0
Unaffected: >= 2.11.0
Architectures: All supported architectures
A vulnerability was discovered in MCollective which allowed for
deserialized YAML from agents without calling safe_load. This allows the
potential for arbitrary code execution on the server.
A remote attacker could possibly execute arbitrary code with the
privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All MCollective users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/mcollective-2.11.0"
Last edited by GLSA on Fri Sep 29, 2017 4:17 am; edited 1 time in total