CVE-2021-27022

CWE-532 — Log File Information Exposure5 documents5 sources
Severity
4.9MEDIUM
EPSS
0.3%
top 43.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Puppet PuppetPuppet Puppet Enterprise
Timeline
PublishedSep 7
Latest updateMay 24

Description

A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages3 packages

▶NVDpuppet/puppet2021.0.0 — 2021.3.0
▶NVDpuppet/puppet_enterprise< 2019.8.8
▶CVEListV5puppet_enterprise2019.8.7

🔴Vulnerability Details

3
GHSA
GHSA-h9c7-5m8v-93ph: A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when th↗2022-05-24
▶
OSV
CVE-2021-27022: A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when th↗2021-09-07
▶
CVEList
CVE-2021-27022: A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when th↗2021-09-07
▶

📋Vendor Advisories

1
Debian
CVE-2021-27022: puppet - A flaw was discovered in bolt-server and ace where running a task with sensitive...↗2021
▶