PT-2021-6608 · Puppet+1 · Puppetdb+1

Published 2021-07-20 · Updated 2024-01-23 · CVE-2021-27021

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Puppet DB (affected versions not specified)

Description A flaw in Puppet DB results in an escalation of privileges, allowing a user to delete tables via an SQL query. This issue is related to a lack of protection measures for the SQL query structure, which can be exploited by a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-1027

CWE-89

Related Identifiers

ALT-PU-2022-3419

BDU:2022-01884

CVE-2021-27021

ROSA-SA-2023-2297

ROSA-SA-2024-2329

Affected Products

Alt Linux

Puppetdb

References · 17

• https://osv.dev/vulnerability/DEBIAN-CVE-2021-27021 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-27021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27021 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-27021 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-27021 · Vendor Advisory
• https://puppet.com/security/cve/cve-2021-27021 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-27021 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-27021 · Security Note
• https://bdu.fstec.ru/vul/2022-01884 · Security Note
• https://github.com/puppetlabs/puppetdb/commit/c146e624d230f7410fb648d58ae28c0e3cd457a2 · Note
• https://github.com/puppetlabs/puppetdb/commit/72bd137511487643a3a6236ad9e72a5dd4a6fadb · Note
• https://github.com/puppetlabs/puppetdb/commit/f8dc81678cf347739838e42cc1c426d96406c266 · Note
• https://t.me/cibsecurity/26278 · Telegram Post
• https://abf.rosalinux.ru/advisories/ROSA-SA-2024-2329 · Note
• https://abf.rosalinux.ru/advisories/ROSA-SA-2023-2297 · Note