CVE-2021-27023

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

Published: Nov 18, 2021
Updated: May 9, 2024
CVE: CVE-2021-27023
GHSA: GHSA-93j5-g845-9wqp
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

No CWE or OWASP classifications available.

Affected Software
References

Software	From	Fixed in
puppet / puppet_server	7.0.0	7.4.2
puppet / puppet_server	-	6.17.1
puppet / puppet_agent	7.0.0	7.12.1
puppet / puppet_agent	-	6.25.1
puppet / puppet_enterprise	-	2019.8.9
puppet / puppet_enterprise	2021.0.0	2021.4
fedoraproject / fedora	35	35.x
puppet	7.0.0	7.12.1
puppet	-	6.25.1

https://lists.fedoraproject.org/archives/list/[email protected]/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
https://puppet.com/security/cve/CVE-2021-27023

Vulnerability Database

289,599

CVE-2021-27023