GHSA-q4g7-jrxv-67r9 CVE-2021-27025

Silent Configuration Failure in Puppet Agent

Medium RubyGems

Severity: 6.5 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 1.11%; Chance of exploitation in the next 30 days. Higher than 65.91% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: —; Not classified
Fix: 7.12.1; Upgrade puppet to this version or later

Description

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.

Affected versions

RubyGems

Package	Vulnerable	Fixed in
puppet	`>= 7.0.0, < 7.12.1`	`7.12.1`
puppet	`< 6.25.1`	`6.25.1`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

puppet RubyGems → `7.12.1`

bundler

bundle update puppet # Gemfile: gem "puppet", ">= 7.12.1"

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2021-27025

Packages

github.com/puppetlabs/puppet

Timeline

Dec 2, 2021 Published
Nov 29, 2024 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-mpmx-gm5v-q789 Puppet uses predictable filenames, allowing arbitrary file overwrite	Medium	Also affects puppet
GHSA-9pvx-fwwh-w289 Puppet does not properly restrict access to node resources	Medium	Also affects puppet
GHSA-qh3g-27jf-3j54 Puppet allows local users to modify the permissions of arbitrary files	Medium	Also affects puppet
GHSA-8c56-v25w-f89c Puppet arbitrary file overwrite	Medium	Also affects puppet
GHSA-v58w-6xc2-w799 Puppet Denial of Service and Arbitrary File Write	Low	Also affects puppet
GHSA-c4mc-49hq-q275 Puppet uses predictable filenames, allowing arbitrary file overwrite	Medium	Also affects puppet
GHSA-6xxq-j39w-g3f6 Puppet Arbitrary Command Execution	Medium	Also affects puppet
GHSA-77hg-g8cc-5r37 Puppet Privilege Escallation	Medium	Also affects puppet

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor