CVE-2021-27023

🗓️ 18 Nov 2021 14:33:18Reported by puppetType

A flaw in Puppet Agent and Puppet Server may leak HTTP credentials when following redirects to a different host. Similar to CVE-2018-1000007

Reporter	Title	Published	Views	Family All 50
FreeBSD	puppet -- Unsafe HTTP Redirect	9 Nov 202100:00	–	freebsd
BDU FSTEC	The vulnerability of the Puppet infrastructure automation tool and its startup application, Puppet Agent, relates to the insecure transfer of credentials. This allows a malicious individual to access confidential information.	5 Dec 202400:00	–	bdu_fstec
Circl	CVE-2021-27023	18 Nov 202118:16	–	circl
CNNVD	Puppet Server 安全漏洞	10 Nov 202100:00	–	cnnvd
CNVD	Puppet Server Information Disclosure Vulnerability	13 Nov 202100:00	–	cnvd
Cvelist	CVE-2021-27023	18 Nov 202114:33	–	cvelist
Debian CVE	CVE-2021-27023	18 Nov 202114:33	–	debiancve
EUVD	EUVD-2021-2488	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 35 Update: puppet-7.12.1-1.fc35	28 Nov 202100:45	–	fedora
Github Security Blog	Unsafe HTTP Redirect in Puppet Agent and Puppet Server	2 Dec 202117:52	–	github

NVD

Node

puppet puppet_agentRange<6.25.1

puppet puppet_agentRange7.0.0–7.12.1

puppet puppet_enterpriseRange<2019.8.9

puppet puppet_enterpriseRange2021.0.0–2021.4

puppet puppet_serverRange<6.17.1

puppet puppet_serverRange7.0.0–7.4.2

Node

fedoraproject fedoraMatch35

[
  {
    "product": "Puppet Enterprise, Puppet Server, Puppet Agent",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Puppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4, Puppet Server prior to 6.17.1, Puppet Server prior to 7.4.2, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1"
      }
    ]
  }
]

Source	Link
puppet	www.puppet.com/security/cve/CVE-2021-27023
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/

17 Jun 2026 03:44Current

7.8High risk

Vulners AI Score7.8

CVSS 25

CVSS 3.19.8

EPSS0.01328