A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3794-1 advisory.

  - A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when     following HTTP redirects to a different host. This is similar to CVE-2018-1000007 (CVE-2021-27023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:3355-1 advisory.

  - A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when     following HTTP redirects to a different host. This is similar to CVE-2018-1000007 (CVE-2021-27023)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4866 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Bugs Fixed:
    2023853 CVE-2021-27025 puppet: silent configuration failure in agent     2023859 CVE-2021-27023 puppet: unsafe HTTP redirect     2027254 CVE-2021-27025 CVE-2021-27023 CVE-2021-27025 puppet: multiple flaws in Satellite Tools     [rhn_satellite_6.10]

    Security Fix(es):
    * Puppet Agent: Unsafe HTTP redirect (CVE-2021-27023)
    * Puppet Agent: Silent configuration failure in agent (CVE-2021-27025)

    Users of Red Hat Satellite Tools on all Red Hat Enterprise Linux versions are advised to upgrade to these     updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4867 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):
    * Puppet Agent: Unsafe HTTP redirect (CVE-2021-27023)
    * Puppet Agent: Silent configuration failure in agent (CVE-2021-27025)

    Bugs Fixed:
    2023853 CVE-2021-27025 puppet: silent configuration failure in agent     2023859 CVE-2021-27023 puppet: unsafe HTTP redirect     2066884 CVE-2021-27025 puppet-agent: puppet: silent configuration failure in agent     [rhn_satellite_6-default]

    Users of Red Hat Satellite Tools on all Red Hat Enterprise Linux versions are advised to upgrade to these     updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1708 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    2023859 puppet: unsafe HTTP redirect (CVE-2021-27023)     2023853 puppet: silent configuration failure in agent (CVE-2021-27025)

    This update fixes the following bugs:

    2070996 Upgrade to Satellite 6.10 fails at db:migrate stage if there are errata reference present for some     ostree\puppet type repos     2070991 Warning: postgresql.service changed on disk, when calling foreman-maintain service restart     2071004 Config report upload failed with No smart proxy server found on [capsule.example.com] and is not     in trusted_hosts     2070984 Uploading external  DISA SCAP content to satellite 6.10 fails with exception Invalid SCAP file     type     2075031 Content Import does not delete version on failure     2070985 Upgrading from Satellite 6.9 to Satellite 6.10.3 fails with error undefined method     operatingsystems for nil:NilClass during the db:migrate step     2070994 Index content is creating duplicated errata in katello_erratum table after upgrading to Satellite     6.10     2070999 Fail to import contents when the connected and disconnected Satellite have different product     labels for the same product     2071002 Error when importing content and same package belongs to multiple repositories     2071006 Content not accessible after importing     2076979 Wrong satellite version on login screen     2077046 Upgrade fails during db:migrate with PG::ForeignKeyViolation: ERROR:  update or delete on table     katello_errata violates foreign key constraint katello_content_facet_errata_errata_id

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1478 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):
    2023859 CVE-2021-27023 - puppet: unsafe HTTP redirect

    This update fixes the following bugs:

    1929347 pulp3: Ensure migration plugin runs in FIPS mode and respects the ALLOWED_CONTENT_CHECKSUMS     configuration     1992267 Incorrect puppet module count when a content view is added to the composite content view.
    1998796 Pulp 3 migration failed with missing repositories.
    2005392 If the migration plan is empty, all repositories get migrated.
    2019563 Missing fields on MD5 repos in repomd.xml on a FIPS enabled satellite     2025804 Option Verify Checksum not listed under Advanced Sync Options     2027086 The katello:pulp3_migration reports wrong failed component names if one or all pulp3 related     services has failed to start during content-migration process     2027127 Pulp 2 to 3 migration fails on certain repos during the upgrade with  FileNotFoundError: [Errno 2]     No such file or directory: in prepare_metadata_files     2027250 CVE-2021-27023 puppetserver: puppet: unsafe HTTP redirect [rhn_satellite_6.9]     2027253 CVE-2021-27023 puppet-agent: puppet: unsafe HTTP redirect [rhn_satellite_6.9]     2032843 pulp3: 2to3 migration fails with Katello::Errors::Pulp3Error: the cursor;_django_curs_XXXX_XXXX     does not exist     2033951 [Pulp3] The pulp2-3 migration fails to migrate Alma Linux BaseOS repo with error     Katello::Errors::Pulp3Error: No declared artifact with relative path images boot.iso     2038739 Extremely difficult to tell what repositories to Verify Checksum on when there are hundreds or     thousands of packages listed as corrupted     2038742 pulp3 content migration failed with Katello::Errors::Pulp3Error: local variable item referenced     before assignment     2039059 Pulp3: Migration fails with error Katello::Errors::Pulp3Error: Empty variable tag     2039112 pulp3 migration stats drastically underestimate migration times     2043742 foreman-rake katello:approve_corrupted_migration_content fails with services     2043933 The pulp2-pulp3 migration should fail if not all the errata content has been migrated while     upgrading to Satellite 6.10     2051970 pulp2to3 migration fails to migrate docker_blob content due to aggregate mongo 100M limit     2061715 Publication creation (during migration to pulp3 as well) can fail if pulp is NFS share

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184159	Puppet Agent 6.x < 6.25.1 / 7.x < 7.12.1 Vulnerability	Nessus	Windows	critical
166696	SUSE SLES12 Security Update : rubygem-puppet (SUSE-SU-2022:3794-1)	Nessus	SuSE Local Security Checks	critical
165425	SUSE SLES12 Security Update : puppet (SUSE-SU-2022:3355-1)	Nessus	SuSE Local Security Checks	critical
161783	RHEL 6 / 7 / 8 : Satellite Tools 6.10.5 Async Bug Fix Update (Important) (RHSA-2022:4866)	Nessus	Red Hat Local Security Checks	critical
161763	RHEL 6 / 7 / 8 : Satellite Tools 6.9.9 Async Bug Fix Update (Important) (RHSA-2022:4867)	Nessus	Red Hat Local Security Checks	critical
160534	RHEL 7 : Satellite 6.10.5 Async Bug Fix Update (Important) (RHSA-2022:1708)	Nessus	Red Hat Local Security Checks	critical
160039	RHEL 7 : Satellite 6.9.9 Async Bug Fix Update (Important) (RHSA-2022:1478)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2021-27023

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical