by Kastro
Paper/Archive/CVE-2021-27023

CVE-2021-27023

puppet — A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.0.720 × 2014.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

Affected

ProductAffectedFixed inSource
Puppet Enterprise, Puppet Server, Puppet AgentPuppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4, Puppet Server prior to 6.17.1, Puppet Server prior to 7.4.2, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refpuppet.com/security/cve/CVE-2021-27023advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7