CVE-2021-27024

CVE-2021-27024 affects Puppet’s Continuous Delivery for Puppet Enterprise (CD4PE). A flaw allows a user with lower privileges to access a Puppet Enterprise API token. The issue is mitigated by CD4PE version 4.10.0. The available sources describe the vulnerability and its fix but do not provide ex...

PT-2021-8199 · Puppet +2 · Puppet Agent +2

Name of the Vulnerable Software and Affected Versions: Puppet Agent affected versions not specified Description: A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'. The iss...

PT-2021-8198 · Puppet +3 · Puppet Agent +4

Name of the Vulnerable Software and Affected Versions: Puppet Agent and Puppet Server affected versions not specified Description: A flaw in Puppet Agent and Puppet Server may result in a leak of HTTP credentials when following HTTP redirects to a different host. This issue is related to the...

PT-2021-17234

Name of the Vulnerable Software and Affected Versions: Continuous Delivery for Puppet Enterprise CD4PE versions prior to 4.10.0 Description: A flaw was discovered in Continuous Delivery for Puppet Enterprise CD4PE that results in a user with lower privileges being able to access a Puppet Enterpri...

PT-2021-17235

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise and other Puppet products affected versions not specified Description: A flaw was discovered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged. Recommendations: At the moment, there...

CVE-2021-27023: Undefined Security Weakness

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007...

CVE-2021-27025: Undefined Security Weakness

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'...

CVE-2021-27026: Insertion of Sensitive Information into Log File

A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged...

CVE-2021-27024: Undefined Security Weakness

A flaw was discovered in Continuous Delivery for Puppet Enterprise CD4PE that results in a user with lower privileges being able to access a Puppet Enterprise API token. This issue is resolved in CD4PE 4.10.0...

CVE-2021-27025

A configuration flaw was found in Puppet Agent where the agent silently ignores Augeas settings. This flaw allows a network attacker to cause a denial of service before the first pluginsync. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availabilit...

CVE-2021-27023

An exposure flaw was found in Puppet Agent and Puppet Server where HTTP credentials were leaked. When the HTTP redirects occurred, the authentication and cookie header was added when following redirects to a different host. This flaw allows an unauthorized network attacker to access sensitive...

Puppet Access Control Error Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. An access control error...

Puppet Server Information Disclosure Vulnerability

Puppet Server is a software from Puppet Labs in the U.S. for pushing configurations from the primary server to other servers. an information disclosure vulnerability exists in Puppet Agent and Puppet Server, which stems from a lack of restrictions and protections in the HTTP transport process,...

Puppet Server 安全漏洞

Puppet Server is a software from Puppet Labs in the U.S. for pushing configurations from the primary server to other servers. an information disclosure vulnerability exists in Puppet Agent and Puppet Server, which stems from a lack of restrictions and protections in the HTTP transport process,...

Puppet CD4PE 安全漏洞

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. An access control error...

Puppet 安全漏洞

Puppet is a set of configuration management tools based on the client/server C/S architecture from Puppet Labs in the United States, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Agent is a Puppet agent end-program. A security...

Puppet Server 日志信息泄露漏洞

Puppet Server is a software from US-based Puppet Labs for pushing configurations from a master server to other servers. Puppet Server suffers from a logging information disclosure vulnerability that stems from the possibility that the software may be logging some sensitive program parameters...

Denial of Service (DoS)

Overview puppet is an automated configuration management tool. Affected versions of this package are vulnerable to Denial of Service DoS prior to the first pluginsync or may silently ignore Augeas settings. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...

Information Disclosure

Overview puppet is an automated configuration management tool. Affected versions of this package are vulnerable to Information Disclosure that may result in a leak of HTTP credentials. Remediation Upgrade puppet to version 6.25.1, 7.12.1 or higher. References - GitHub Commit - GitHub Commit -...

puppet -- Unsafe HTTP Redirect

Puppet reports: A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007...