Resource management error in Puppet Agent and Puppet Enterprise - CVE-2021-27025

Vulnerability identifier: #VU62793

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-27025

CWE-ID: CWE-399

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the application silently ignore Augeas settings prior to the first pluginsync. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.

Puppet Agent
Puppet Enterprise
tfm-rubygem-smart_proxy_openscap (Red Hat package)
foreman-installer (Red Hat package)
foreman (Red Hat package)
tfm-rubygem-katello (Red Hat package)
satellite (Red Hat package)
puppetserver (Red Hat package)
puppet-agent (Red Hat package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
puppet (Red Hat package)
puppet
Red Hat Enterprise Linux Server - Extended Life Cycle Support
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for x86_64
Fedora
Red Hat Satellite
Red Hat OpenStack

Install updates from vendor's website.

Puppet Agent - addressed in versions 6.25.1, 7.12.1
Puppet Enterprise - addressed in versions 2019.8.9, 2021.4.0
tfm-rubygem-smart_proxy_openscap (Red Hat package) - update to 0.9.2-1.el7sat
foreman-installer (Red Hat package) - update to 2.5.2.14-1.el7sat
foreman (Red Hat package) - update to 2.5.2.21-1.el7sat
tfm-rubygem-katello (Red Hat package) - update to 4.1.1.55-1.el7sat
Red Hat Satellite - update to 6.10.5
satellite (Red Hat package) - update to 6.10.5-1.el7sat
puppetserver (Red Hat package) - update to 6.18.0-1.el7sat
puppet-agent (Red Hat package) - addressed in versions 6.26.0-1.el6sat, 6.26.0-1.el7sat, 6.26.0-1.el8sat
puppet (Red Hat package) - update to 5.5.10-14.el8ost
puppet - addressed in versions 6.25.1-1.el8, 7.12.1-1.fc35
Red Hat OpenStack - addressed in versions 16.1.9, 16.2.4

• https://puppet.com/security/cve/cve-2021-27025
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/

• Multiple vulnerabilities in Puppet Labs products
• Multiple vulnerabilities in Red Hat Satellite
• Red Hat Enterprise Linux update for Puppet Agent
• Multiple vulnerabilities in Red Hat Satellite
• Red Hat OpenStack Platform 16.2 update for puppet
• Red Hat OpenStack Platform 16.1 update for puppet
• Fedora EPEL 8 update for puppet
• Fedora 35 update for puppet