Read the docs
TI-2021-08596 Aliases CVE-2021-27023GHSA-93j5-g845-9wqp

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP…

Priority MEDIUM 45Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

Why it matters now

EPSS 0.01372 72nd percentileScored 2026-11-07
Fix Fixed puppet (RubyGems): 7.12.1, 6.25.1Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Puppet Enterprise, Puppet Server, Puppet AgentPuppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4, Puppet Server prior to 6.17.1, Puppet Server prior to 7.4.2, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1—No fix listedCNA
—puppet (RubyGems)7.0.0 to before 7.12.17.12.1Patch availableGHSA-93j5-g845-9wqp
—puppet (RubyGems)before 6.25.16.25.1Patch availableGHSA-93j5-g845-9wqp
  • Puppet Enterprise, Puppet Server, Puppet Agent Vendor— Affected Puppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4, Puppet Server prior to 6.17.1, Puppet Server prior to 7.4.2, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1 Fixed in — No fix listed CNA
  • puppet (RubyGems) Vendor— Affected 7.0.0 to before 7.12.1 Fixed in 7.12.1 Patch available GHSA-93j5-g845-9wqp
  • puppet (RubyGems) Vendor— Affected before 6.25.1 Fixed in 6.25.1 Patch available GHSA-93j5-g845-9wqp

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:puppet:puppet_agent:*:*:*:*:*:*:*:*before 6.25.1; 7.0.0 to before 7.12.1VulnerablePuppet
cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*before 2019.8.9; 2021.0.0 to before 2021.4VulnerablePuppet
cpe:2.3:a:puppet:puppet_server:*:*:*:*:*:*:*:*before 6.17.1; 7.0.0 to before 7.4.2VulnerablePuppet
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:puppet:puppet_agent:*:*:*:*:*:*:*:* Versions before 6.25.1; 7.0.0 to before 7.12.1 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* Versions before 2019.8.9; 2021.0.0 to before 2021.4 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet_server:*:*:*:*:*:*:*:* Versions before 6.17.1; 7.0.0 to before 7.4.2 Vulnerable ·Puppet
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-93j5-g845-9wqp puppet (RubyGems) Fixed in 7.12.1 Advisory →
  • Fix · GHSA-93j5-g845-9wqp puppet (RubyGems) Fixed in 6.25.1 Advisory →

Red Hat 4 advisories

  • RHSA-2022:4866 Released 2022-06-01 · Red Hat rating Important
    Satellite Tools 6.10.5 Async Bug Fix Update
    • Satellite Tools 6.10 (v. 6.10.ELS Server) puppet-agent-6.26.0-1.el6sat
    • Satellite Tools 6.10 (v. 7 Client) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7 ComputeNode) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7 Workstation) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.2.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.3.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.4.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.4.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.4.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.6.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.6.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.6.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.7.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.7.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.7.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 8) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.1.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.1.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.2.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.2.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.2.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.6.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.6.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.6.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. RHEL-ALT 7.6 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 for RHEL 8.2.E4S puppet-agent-6.26.0-1.el8sat
  • RHSA-2022:4867 Released 2022-06-01 · Red Hat rating Important
    Satellite Tools 6.9.9 Async Bug Fix Update
    • Satellite Tools 6.9 (v. 6.9.ELS Server) puppet-agent-6.26.0-1.el6sat
    • Satellite Tools 6.9 (v. 7 Client) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7 ComputeNode) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7 Workstation) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.2.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.3.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.4.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.4.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.4.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.EUS Compute Node) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.EUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.EUS Compute Node) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.EUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 8) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.0.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.1.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.1.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.2.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.2.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.2.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.4.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.4.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.4.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. RHEL-ALT 7.6 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 for RHEL 8.2.E4S puppet-agent-6.26.0-1.el8sat
  • RHSA-2022:1708 Released 2022-05-04 · Red Hat rating Important
    Satellite 6.10.5 Async Bug Fix Update
    • Red Hat Satellite 6.10 puppet-agent-6.26.0-1.el7sat, puppetserver-6.18.0-1.el7sat
    • Red Hat Satellite Capsule 6.10 puppet-agent-6.26.0-1.el7sat, puppetserver-6.18.0-1.el7sat
Show 1 more Red Hat advisories
  • RHSA-2022:1478 Released 2022-04-20 · Red Hat rating Important
    Satellite 6.9.9 Async Bug Fix Update
    • Red Hat Satellite 6.9 puppet-agent-6.26.0-1.el7sat, puppetserver-6.18.0-1.el7sat
    • Red Hat Satellite Capsule 6.9 puppet-agent-6.26.0-1.el7sat, puppetserver-6.18.0-1.el7sat

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6.10Fixed RHSA-2022:1708
Red Hat Satellite 6.9Fixed RHSA-2022:1478
Red Hat Satellite Capsule 6.10Fixed RHSA-2022:1708
Red Hat Satellite Capsule 6.9Fixed RHSA-2022:1478
Satellite Tools 6.10 (v. 6.10.ELS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 Client)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 ComputeNode)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 Workstation)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.2.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.3.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.4.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.4.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.4.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.6.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.6.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.6.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.7.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.7.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.7.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.1.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.1.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.2.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.2.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.2.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.6.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.6.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.6.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. RHEL-ALT 7.6 Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 for RHEL 8.2.E4SFixed RHSA-2022:4866
Satellite Tools 6.9 (v. 6.9.ELS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 Client)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 ComputeNode)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 Workstation)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.2.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.3.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.4.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.4.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.4.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.EUS Compute Node)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.EUS Compute Node)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.0.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.1.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.1.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.2.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.2.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.2.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.4.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.4.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.4.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. RHEL-ALT 7.6 Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 for RHEL 8.2.E4SFixed RHSA-2022:4867
Not affected: 9 products
  • Red Hat OpenStack Platform 10 (Newton)
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Satellite 6.10
  • Red Hat Satellite 6.9
  • Red Hat Satellite Capsule 6.10
  • Red Hat Satellite Capsule 6.9
  • Red Hat Update Infrastructure 3 for Cloud Providers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27023
  2. 2026-10-03 Alias added: GHSA-93j5-g845-9wqp

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences