CVE-2021-27018 Security feature bypass in Puppet Remediate
Attackers can bypass certificate validation in Puppet Remediate when configured to use Tenable.sc as the data source.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27018?
CVE-2021-27018 is a high-severity vulnerability in Puppet Remediate, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source.
Weakness: CWE-295
Which versions are affected by CVE-2021-27018?
It affects 1 product.
Products include Puppet Remediate.
How do I fix CVE-2021-27018?
No fix has been published for CVE-2021-27018 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27018 being exploited?
There is no known exploitation of CVE-2021-27018 in the wild and no public exploit code.
Sources
Also known as GHSA-22qw-g2hg-q8w6, UBUNTU-CVE-2021-27018.