CVE-2021-27023

Published: Nov 18, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

Affected (7)

Products: Puppet: Puppet Agent, Puppet Enterprise, Puppet Server · Fedoraproject: Fedora

3 products

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Puppet Puppet Agent	Before 6.25.1
Puppet Puppet Agent	From 7.0.0 to 7.12.1
Puppet Puppet Enterprise	Before 2019.8.9
Puppet Puppet Enterprise	From 2021.0.0 to 2021.4
Puppet Puppet Server	Before 6.17.1
Puppet Puppet Server	From 7.0.0 to 7.4.2

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 35

References (4)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/

Source: security@puppet.com

https://puppet.com/security/cve/CVE-2021-27023

Source: security@puppet.com

Vendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/

Source: af854a3a-2127-422b-91ae-364da2661108

https://puppet.com/security/cve/CVE-2021-27023

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.