Vulnerability in Puppet Puppet_agent
CVE-2021-27023
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
EPSS: 0.013 (67.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Puppet Puppet_agent
- Puppet Puppet_enterprise
- Puppet Puppet_server
- Fedoraproject Fedora — versions 35
- N/a Puppet Enterprise, Server, Agent — versions Puppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4, Puppet Server prior to 6.17.1, Puppet Server prior to 7.4.2, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1
References
- security@puppet.com (x_refsource_MISC, Vendor Advisory)
- security@puppet.com (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2021-27023?
- CVE-2021-27023 is a critical-severity vulnerability in Puppet Puppet_agent. CVSS score: 9.8/10. Published 2021-11-18.
- How severe is CVE-2021-27023?
- Critical severity. CVSS v3 base score is 9.8 out of 10.