CVE-2021-27023: 
Ruby vulnerability analysis and mitigation

A security vulnerability (CVE-2021-27023) was discovered in Puppet Agent and Puppet Server that could result in a leak of HTTP credentials when following HTTP redirects to a different host. This vulnerability is similar to CVE-2018-1000007. The issue was disclosed on November 9, 2021, affecting multiple versions of Puppet Enterprise, Puppet Server, and Puppet Agent (Puppet Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The flaw specifically relates to the handling of HTTP redirects when they point to different hosts, potentially exposing sensitive HTTP credentials in the process (NVD).

The vulnerability could lead to the exposure of HTTP credentials when the affected Puppet components follow HTTP redirects to different hosts. This could potentially allow attackers to intercept and capture sensitive authentication credentials (Puppet Advisory).

The vulnerability affects multiple versions of Puppet software including Puppet Enterprise prior to 2019.8.9 and 2021.4, Puppet Server prior to 6.17.1 and 7.4.2, and Puppet Agent prior to 6.25.1 and 7.12.1 (Puppet Advisory).

The vulnerability has been patched in multiple versions: Puppet Enterprise 2019.8.9 and 2021.4, Puppet Server 6.17.1 and 7.4.2, and Puppet Agent 6.25.1 and 7.12.1. Users are advised to upgrade to these patched versions to mitigate the vulnerability (Puppet Advisory).