CVE-2021-27023: Fedoraproject Fedora

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

Affected products

• Fedoraproject Fedora: version 35 only
• Puppet Puppet Agent: before 6.25.1 (fixed in 6.25.1); from 7.0.0, before 7.12.1 (fixed in 7.12.1)
• Puppet Puppet Enterprise: before 2019.8.9 (fixed in 2019.8.9); from 2021.0.0, before 2021.4 (fixed in 2021.4)
• Puppet Puppet Server: before 6.17.1 (fixed in 6.17.1); from 7.0.0, before 7.4.2 (fixed in 7.4.2)

Published 2021-11-18. Last modified 2026-06-17.