PT-2021-6808 · Puppet · Puppet

Published 2021-09-07 · Updated 2022-01-24 · CVE-2021-27022

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions bolt-server and ace (affected versions not specified) Puppet (affected versions not specified)

Description A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes). The vulnerability in Puppet is related to insufficient protection of registration data, allowing a remote attacker to access confidential data.

Recommendations For bolt-server and ace, consider restricting the logging of tasks with sensitive parameters until a fix is available. For Puppet, restrict access to registration data to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2022-02231

CVE-2021-27022

Affected Products

Puppet

References · 11

• https://osv.dev/vulnerability/CVE-2021-27022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27022 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-27022 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-27022 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-27022 · Vendor Advisory
• https://puppet.com/security/cve/cve-2021-27022 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02231 · Security Note
• https://ubuntu.com/security/CVE-2021-27022 · Vendor Advisory
• https://puppet.com/security/cve/cve-2021-27022/%5D · Note
• https://puppet.com/security/cve/cve-2021-27022/] · Note
• https://t.me/cibsecurity/28355 · Telegram Post