PT-2021-6809 · Puppet+1 · Puppetdb+1

Published 2021-08-30 · Updated 2022-12-26 · CVE-2021-27019

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PuppetDB (affected versions not specified)

Description The issue is related to insufficient protection of registration data in the PuppetDB database management system. This allows a remote attacker to exploit the weakness and gain access to confidential data. Additionally, PuppetDB logging includes potentially sensitive system information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

ALT-PU-2022-3419

BDU:2022-02232

CVE-2021-27019

Affected Products

Alt Linux

Puppetdb

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-27019 · Security Note
• https://bdu.fstec.ru/vul/2022-02232 · Security Note
• https://puppet.com/security/cve/CVE-2021-27019 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-27019 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-27019 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-27019 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-27019 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27019 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-27019 · Vendor Advisory