Description
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Puppet Enterprise, Puppet Server, Puppet Agent | Puppet Enterprise prior to 2019.8.9, Puppet Enterprise prior to 2021.4, Puppet Server prior to 6.17.1, Puppet Server prior to 7.4.2, Puppet Agent prior to 6.25.1, Puppet Agent prior to 7.12.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | puppet | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | puppet | No fix yet | — |
| Ubuntu 20.04 LTS | puppet | No fix yet | — |
| Ubuntu 18.04 LTS | puppet | No fix yet | — |
| Ubuntu 14.04 LTS | puppet | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | puppet | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | puppet-agent | 6.26.0-1.el7sat | RHSA-2022:1708, RHSA-2022:1478 |
| Red Hat Satellite Capsule 6 | puppetserver | 6.18.0-1.el7sat | RHSA-2022:1708, RHSA-2022:1478 |
| Red Hat Satellite 6 | puppet-agent | 6.26.0-1.el7sat | RHSA-2022:1708, RHSA-2022:1478 |
| Red Hat Satellite 6 | puppetserver | 6.18.0-1.el7sat | RHSA-2022:1708, RHSA-2022:1478 |
| Red Hat Rhel Satellite Tools 6 | puppet-agent | 6.26.0-1.el6sat | RHSA-2022:4867, RHSA-2022:4866 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | puppet | 3.8.5-15.18.1 | SUSE-SU-2022:3355-1 |
| SLES 12 | rubygem-puppet | 4.8.1-32.6.1 | SUSE-SU-2022:3794-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | puppet | >= 7.0.0, < 7.12.1 | 7.12.1 | GHSA-93j5-g845-9wqp |
| RubyGems | puppet | < 6.25.1 | 6.25.1 | GHSA-93j5-g845-9wqp |
Advisories 6
- RHSA-2022:4866 Red Hat Security Advisory: Satellite Tools 6.10.5 Async Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:4867 Red Hat Security Advisory: Satellite Tools 6.9.9 Async Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:1708 Red Hat Security Advisory: Satellite 6.10.5 Async Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:1478 Red Hat Security Advisory: Satellite 6.9.9 Async Bug Fix Update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2022:3355-1 Security update for puppet SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3794-1 Security update for rubygem-puppet SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://puppet.com/security/cve/CVE-2021-27023
- FEDORA-2021-1c0e788093 vendor-advisory