CVE:CVE-2021-27023
CNNVD:CNNVD-202111-975
Puppet Server是美国Puppet实验室的一款用于将配置从主服务器推送到其他服务器的软件。
Puppet Agent 和 Puppet Server存在安全漏洞，该漏洞源于HTTP传输过程缺少限制与保护。该漏洞可能导致执行HTTP重定向到其他主机时出现HTTP凭据泄露。
solution:Upgrade puppet puppet_agent to a higher version than 6.25.1,7.12.1,and avoid the version (,6.25.1),[7.0.0,7.12.1); Upgrade puppet puppet_enterprise to a higher version than 2019.8.9,2021.4,and avoid the version (,2019.8.9),[2021.0.0,2021.4); Upgrade puppet puppet_server to a higher version than 6.17.1,7.4.2,and avoid the version (,6.17.1),[7.0.0,7.4.2); Upgrade fedoraproject fedora to a higher version than 35,and avoid the version 35