Read the docs
TI-2021-08598 Aliases CVE-2021-27025GHSA-q4g7-jrxv-67r9

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings…

Priority LOW 31Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 71 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

Why it matters now

EPSS 0.01109 66th percentileScored 2026-11-07
Fix Partial puppet (RubyGems): 7.12.1, 6.25.1Red Hat: 5 advisoriesRed Hat: 71 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Puppet Enterprise, Puppet Agent- Puppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4.0, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1, Puppet Agent 5.5.x—No fix listedCNA
—puppet (RubyGems)7.0.0 to before 7.12.17.12.1Patch availableGHSA-q4g7-jrxv-67r9
—puppet (RubyGems)before 6.25.16.25.1Patch availableGHSA-q4g7-jrxv-67r9
  • Puppet Enterprise, Puppet Agent Vendor— Affected - Puppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4.0, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1, Puppet Agent 5.5.x Fixed in — No fix listed CNA
  • puppet (RubyGems) Vendor— Affected 7.0.0 to before 7.12.1 Fixed in 7.12.1 Patch available GHSA-q4g7-jrxv-67r9
  • puppet (RubyGems) Vendor— Affected before 6.25.1 Fixed in 6.25.1 Patch available GHSA-q4g7-jrxv-67r9

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:puppet:puppet:*:*:*:*:enterprise:*:*:*2021.0.0 to before 2021.4.0VulnerablePuppet
cpe:2.3:a:puppet:puppet_agent:*:*:*:*:*:*:*:*before 6.25.1; 5.5.0 – 5.5.22; 7.0.0 to before 7.12.1VulnerablePuppet
cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*before 2019.8.9VulnerablePuppet
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
  • cpe:2.3:a:puppet:puppet:*:*:*:*:enterprise:*:*:* Versions 2021.0.0 to before 2021.4.0 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet_agent:*:*:*:*:*:*:*:* Versions before 6.25.1; 5.5.0 – 5.5.22; 7.0.0 to before 7.12.1 Vulnerable ·Puppet
  • cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* Versions before 2019.8.9 Vulnerable ·Puppet
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject

Remediation

  • Fix · GHSA-q4g7-jrxv-67r9 puppet (RubyGems) Fixed in 7.12.1 Advisory →
  • Fix · GHSA-q4g7-jrxv-67r9 puppet (RubyGems) Fixed in 6.25.1 Advisory →

Red Hat 5 advisories

  • RHSA-2022:8862 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.1.9 (puppet) security update
    • Red Hat OpenStack Platform 16.1 puppet-5.5.10-14.el8ost, puppet-headless-5.5.10-14.el8ost, puppet-server-5.5.10-14.el8ost
  • RHSA-2022:8846 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack Platform 16.2.4 (puppet) security update
    • Red Hat OpenStack Platform 16.2 puppet-5.5.10-14.el8ost, puppet-headless-5.5.10-14.el8ost, puppet-server-5.5.10-14.el8ost
  • RHSA-2022:4866 Released 2022-06-01 · Red Hat rating Important
    Satellite Tools 6.10.5 Async Bug Fix Update
    • Satellite Tools 6.10 (v. 6.10.ELS Server) puppet-agent-6.26.0-1.el6sat
    • Satellite Tools 6.10 (v. 7 Client) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7 ComputeNode) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7 Workstation) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.2.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.3.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.4.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.4.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.4.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.6.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.6.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.6.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.7.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.7.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 7.7.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 (v. 8) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.1.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.1.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.2.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.2.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.2.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.4.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.6.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.6.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. 8.6.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.10 (v. RHEL-ALT 7.6 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.10 for RHEL 8.2.E4S puppet-agent-6.26.0-1.el8sat
Show 2 more Red Hat advisories
  • RHSA-2022:4867 Released 2022-06-01 · Red Hat rating Important
    Satellite Tools 6.9.9 Async Bug Fix Update
    • Satellite Tools 6.9 (v. 6.9.ELS Server) puppet-agent-6.26.0-1.el6sat
    • Satellite Tools 6.9 (v. 7 Client) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7 ComputeNode) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7 Workstation) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.2.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.3.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.4.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.4.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.4.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.EUS Compute Node) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.EUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.6.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.AUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.E4S Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.EUS Compute Node) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.EUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 7.7.TUS Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 (v. 8) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.0.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.1.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.1.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.2.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.2.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.2.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.4.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.4.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.4.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.AUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.E4S Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.EUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. 8.6.TUS Server) puppet-agent-6.26.0-1.el8sat
    • Satellite Tools 6.9 (v. RHEL-ALT 7.6 Server) puppet-agent-6.26.0-1.el7sat
    • Satellite Tools 6.9 for RHEL 8.2.E4S puppet-agent-6.26.0-1.el8sat
  • RHSA-2022:1708 Released 2022-05-04 · Red Hat rating Important
    Satellite 6.10.5 Async Bug Fix Update
    • Red Hat Satellite 6.10 puppet-agent-6.26.0-1.el7sat, puppetserver-6.18.0-1.el7sat
    • Red Hat Satellite Capsule 6.10 puppet-agent-6.26.0-1.el7sat, puppetserver-6.18.0-1.el7sat

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Update Infrastructure 3 for Cloud ProvidersAffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:8862
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:8846
Red Hat Satellite 6.10Fixed RHSA-2022:1708
Red Hat Satellite Capsule 6.10Fixed RHSA-2022:1708
Satellite Tools 6.10 (v. 6.10.ELS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 Client)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 ComputeNode)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7 Workstation)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.2.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.3.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.4.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.4.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.4.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.6.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.6.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.6.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.7.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.7.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 7.7.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.1.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.1.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.2.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.2.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.2.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.4.TUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.6.AUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.6.E4S Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. 8.6.EUS Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 (v. RHEL-ALT 7.6 Server)Fixed RHSA-2022:4866
Satellite Tools 6.10 for RHEL 8.2.E4SFixed RHSA-2022:4866
Satellite Tools 6.9 (v. 6.9.ELS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 Client)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 ComputeNode)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7 Workstation)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.2.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.3.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.4.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.4.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.4.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.EUS Compute Node)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.6.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.EUS Compute Node)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 7.7.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.0.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.1.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.1.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.2.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.2.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.2.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.4.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.4.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.4.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.AUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.E4S Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.EUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. 8.6.TUS Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 (v. RHEL-ALT 7.6 Server)Fixed RHSA-2022:4867
Satellite Tools 6.9 for RHEL 8.2.E4SFixed RHSA-2022:4867
Not affected: 2 products
  • Red Hat Satellite 6.10
  • Red Hat Satellite Capsule 6.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27025
  2. 2026-10-03 Alias added: GHSA-q4g7-jrxv-67r9

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences