CVE-2021-27025

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-18 · updated 2026-06-17

Description

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

Affected products

Fedoraproject Fedora: 35
Puppet Agent: from 2021.0.0 before 2021.4.0 — fixed in 2021.4.0
Puppet Agent: before 6.25.1; from 5.5.0 through 5.5.22; from 7.0.0 before 7.12.1 — fixed in 6.25.1, 7.12.1
Puppet Enterprise: before 2019.8.9 — fixed in 2019.8.9

How to fix

Upgrade to a fixed version: Puppet Agent 2021.4.0; Puppet Agent 6.25.1, 7.12.1; Puppet Enterprise 2019.8.9. Check the vendor advisory for mitigations.

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
https://puppet.com/security/cve/cve-2021-27025
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62SELE7EKVKZL4GABFMVYMIIUZ7FPEF7/
https://puppet.com/security/cve/cve-2021-27025

Get alerted when CVE-2021-27025 or the next vulnerability affects your stack