CVE-2021-27023
First published: Thu Nov 18 2021(Updated: )
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Credit: security@puppet.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Puppet Puppet Agent | <6.25.1 | |
| Puppet Puppet Agent | >=7.0.0<7.12.1 | |
| Puppet Puppet Enterprise | <2019.8.9 | |
| Puppet Puppet Enterprise | >=2021.0.0<2021.4 | |
| Puppet Puppet Server | <6.17.1 | |
| Puppet Puppet Server | >=7.0.0<7.4.2 | |
| Fedoraproject Fedora | =35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
- https://puppet.com/security/cve/CVE-2021-27023
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
Frequently Asked Questions
What is CVE-2021-27023?
CVE-2021-27023 is a vulnerability in Puppet Agent and Puppet Server that can result in a leak of HTTP credentials.
How severe is CVE-2021-27023?
CVE-2021-27023 has a severity rating of 9.8 (critical).
Which software is affected by CVE-2021-27023?
Puppet Agent (versions up to 6.25.1 and between 7.0.0 and 7.12.1), Puppet Enterprise (versions up to 2019.8.9 and between 2021.0.0 and 2021.4), and Puppet Server (versions up to 6.17.1 and between 7.0.0 and 7.4.2) are affected by CVE-2021-27023.
How can CVE-2021-27023 be fixed?
To fix CVE-2021-27023, it is recommended to upgrade Puppet Agent, Puppet Enterprise, and Puppet Server to the latest versions available.
Where can I find more information about CVE-2021-27023?
More information about CVE-2021-27023 can be found at the following references: [Reference 1](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/) and [Reference 2](https://puppet.com/security/cve/CVE-2021-27023).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/event
- agent/first-publish-date
- agent/tags
- agent/description
- vendor/puppet
- canonical/puppet puppet agent
- version/puppet puppet agent/7.0.0
- canonical/puppet puppet enterprise
- version/puppet puppet enterprise/2021.0.0
- canonical/puppet puppet server
- version/puppet puppet server/7.0.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35