Vendor
A deserialization vulnerability in Puppet report-processing allows arbitrary code execution via crafted PUT requests.