CVE-2021-27025

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
puppetCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 38%
VendorProductVersion
puppetpuppet
2021.0.0 ≤
𝑥
< 2021.4.0
puppetpuppet_agent
𝑥
< 6.25.1
puppetpuppet_agent
5.5.0 ≤
𝑥
≤ 5.5.22
puppetpuppet_agent
7.0.0 ≤
𝑥
< 7.12.1
puppetpuppet_enterprise
𝑥
< 2019.8.9
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
puppet
bullseye
vulnerable
buster
ignored
stretch
ignored
puppet-agent
bookworm
7.23.0-1
fixed
bullseye
ignored
buster
ignored
stretch
ignored
sid
8.4.0-2
fixed
trixie
8.4.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
puppet
noble
dne
mantic
dne
lunar
dne
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
References
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
https://puppet.com/security/cve/cve-2021-27025
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
https://puppet.com/security/cve/cve-2021-27025