MEDIUM6.5

GHSA-93j5-g845-9wqp

Unsafe HTTP Redirect in Puppet Agent and Puppet Server

Quick fix

GHSA-93j5-g845-9wqp — puppet: upgrade to the fixed version with the command below.

bundle update puppet

Details

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/puppet

Introduced in: 7.0.0Fixed in: 7.12.1

Fixbundle update puppet

RubyGems/puppet

Introduced in: 0Fixed in: 6.25.1

Fixbundle update puppet

References

https://nvd.nist.gov/vuln/detail/CVE-2021-27023[ADVISORY]
https://github.com/puppetlabs/puppet[PACKAGE]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puppet/CVE-2021-27023.yml[WEB]
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7[WEB]
https://puppet.com/security/cve/CVE-2021-27023[WEB]