A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first pluginsync.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of emr-puppet installed on the remote host is prior to 6.17.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2EMR-PUPPET-2023-001 advisory.

  - A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be     vulnerable to a Denial of Service condition prior to the first 'pluginsync'. (CVE-2021-27025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8846 advisory.

    Puppet lets you centrally manage every important aspect of your system using a     cross-platform specification language that manages all the separate elements     normally aggregated in different files, like users, cron jobs, and hosts,     along with obviously discrete elements like packages, services, and files. Provides the central puppet     server daemon which provides manifests to clients.
    The server can also function as a certificate authority and file server. This puppet headless subpackage     may be used when there is no need to     have puppet agent running as a service, for example, in a container     image.

    Security fix(es):

    puppet: silent configuration failure in agent: (CVE-2021-27025)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments,     and other related information, refer to the CVE page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:8862 advisory.

    A network tool for managing many disparate systems

    Security Fix(es):

    * silent configuration failure in agent (CVE-2021-27025)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE     page listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4866 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Bugs Fixed:
    2023853 CVE-2021-27025 puppet: silent configuration failure in agent     2023859 CVE-2021-27023 puppet: unsafe HTTP redirect     2027254 CVE-2021-27025 CVE-2021-27023 CVE-2021-27025 puppet: multiple flaws in Satellite Tools     [rhn_satellite_6.10]

    Security Fix(es):
    * Puppet Agent: Unsafe HTTP redirect (CVE-2021-27023)
    * Puppet Agent: Silent configuration failure in agent (CVE-2021-27025)

    Users of Red Hat Satellite Tools on all Red Hat Enterprise Linux versions are advised to upgrade to these     updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:4867 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):
    * Puppet Agent: Unsafe HTTP redirect (CVE-2021-27023)
    * Puppet Agent: Silent configuration failure in agent (CVE-2021-27025)

    Bugs Fixed:
    2023853 CVE-2021-27025 puppet: silent configuration failure in agent     2023859 CVE-2021-27023 puppet: unsafe HTTP redirect     2066884 CVE-2021-27025 puppet-agent: puppet: silent configuration failure in agent     [rhn_satellite_6-default]

    Users of Red Hat Satellite Tools on all Red Hat Enterprise Linux versions are advised to upgrade to these     updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1708 advisory.

    Red Hat Satellite is a system management solution that allows organizations to configure and maintain     their systems without the necessity to provide public Internet access to their servers or other client     systems. It performs provisioning and configuration management of predefined standard operating     environments.

    Security Fix(es):

    2023859 puppet: unsafe HTTP redirect (CVE-2021-27023)     2023853 puppet: silent configuration failure in agent (CVE-2021-27025)

    This update fixes the following bugs:

    2070996 Upgrade to Satellite 6.10 fails at db:migrate stage if there are errata reference present for some     ostree\puppet type repos     2070991 Warning: postgresql.service changed on disk, when calling foreman-maintain service restart     2071004 Config report upload failed with No smart proxy server found on [capsule.example.com] and is not     in trusted_hosts     2070984 Uploading external  DISA SCAP content to satellite 6.10 fails with exception Invalid SCAP file     type     2075031 Content Import does not delete version on failure     2070985 Upgrading from Satellite 6.9 to Satellite 6.10.3 fails with error undefined method     operatingsystems for nil:NilClass during the db:migrate step     2070994 Index content is creating duplicated errata in katello_erratum table after upgrading to Satellite     6.10     2070999 Fail to import contents when the connected and disconnected Satellite have different product     labels for the same product     2071002 Error when importing content and same package belongs to multiple repositories     2071006 Content not accessible after importing     2076979 Wrong satellite version on login screen     2077046 Upgrade fails during db:migrate with PG::ForeignKeyViolation: ERROR:  update or delete on table     katello_errata violates foreign key constraint katello_content_facet_errata_errata_id

    Users of Red Hat Satellite are advised to upgrade to these updated packages, which fix these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
184155	Puppet Agent < 6.25.1 / 7.x < 7.12.1 Vulnerability	Nessus	Windows	medium
184146	Puppet Enterprise < 2019.8.9 / 2021.x < 2021.4.0 DoS	Nessus	Misc.	medium
182028	Amazon Linux 2 : emr-puppet (ALASEMR-PUPPET-2023-001)	Nessus	Amazon Linux Local Security Checks	medium
170385	RHEL 8 : Red Hat OpenStack Platform 16.2.4 (puppet) (RHSA-2022:8846)	Nessus	Red Hat Local Security Checks	medium
170359	RHEL 8 : Red Hat OpenStack Platform 16.1.9 (puppet) (RHSA-2022:8862)	Nessus	Red Hat Local Security Checks	medium
161783	RHEL 6 / 7 / 8 : Satellite Tools 6.10.5 Async Bug Fix Update (Important) (RHSA-2022:4866)	Nessus	Red Hat Local Security Checks	critical
161763	RHEL 6 / 7 / 8 : Satellite Tools 6.9.9 Async Bug Fix Update (Important) (RHSA-2022:4867)	Nessus	Red Hat Local Security Checks	critical
160534	RHEL 7 : Satellite 6.10.5 Async Bug Fix Update (Important) (RHSA-2022:1708)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2021-27025

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

critical