CVE-2021-27021 SQL injection in Puppet DB

What is CVE-2021-27021?

CVE-2021-27021 is a high-severity SQL injection vulnerability in Puppet Puppet Enterprise, published on 20 Jul 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.

Weakness: CWE-89, CWE-1027

Which versions are affected by CVE-2021-27021?

It affects 3 products.

Products include Puppet Puppet, Puppet Puppet Enterprise, Puppet Puppetdb.

How do I fix CVE-2021-27021?

Apply the vendor's patch.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2021-27021 being exploited?

There is no known exploitation of CVE-2021-27021 in the wild and no public exploit code.

Other vulnerabilities in Puppet Puppet Enterprise

• CVE-2016-2785 Puppet Improper Access Control Critical 9.8
• CVE-2018-6513 Privilege escalation in Puppet Enterprise and Puppet Agent High 8.8
• CVE-2018-6514 Privilege escalation in Puppet Agent High 7.8
• CVE-2018-6515 Code injection in Puppet Agent High 7.8
• CVE-2013-1655 Puppet Improper Input Validation vulnerability High 7.5

All Puppet Puppet Enterprise vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2021-27021, GHSA-j664-pgf6-rhhh, UBUNTU-CVE-2021-27021.