Unsafe HTTP Redirect in Puppet Agent and Puppet Server

CRITICAL 9.8CVE-2021-27023 · GHSA-93j5-g845-9wqp · Published 18/11/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
puppet RubyGems	`≥ 7.0.0, < 7.12.1< 6.25.1`	`7.12.16.25.1`
puppet agent puppet	`≥ 7.0.0, < 7.12.1< 6.25.1`	`7.12.16.25.1`
puppet enterprise puppet	`≥ 2021.0.0, < 2021.4< 2019.8.9`	`2021.42019.8.9`
puppet server puppet	`≥ 7.0.0, < 7.4.2< 6.17.1`	`7.4.26.17.1`

Description

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

NVD description

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

References

nvd.nist.gov/vuln/detail/CVE-2021-27023 · ADVISORY
puppetlabs/puppet · PACKAGE
rubysec/ruby-advisory-db · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7 · WEB
puppet.com/security/cve/CVE-2021-27023 · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free