CVE-2021-27017 - Vulnerability Details - OpenCVE

Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Puppet	Puppet Agent

No data.

No data.

References

Link	Providers
https://nvd.nist.gov/vuln/detail/CVE-2021-27017
https://puppet.com/security/cve/CVE-2021-27017
https://www.cve.org/CVERecord?id=CVE-2021-27017
https://www.puppet.com/security/cve/cve-2021-27017-deserialization-untrusted-data

History

Fri, 07 Feb 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 07 Feb 2025 19:45:00 +0000

Type	Values Removed	Values Added
Description	A flaw was found in puppet-agent. Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.	Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.
Title	puppet-agent: Deserialization of untrusted data	Deserialization of untrusted data
References		https://www.puppet.com/security/cve/cve-2021-27017-deserialization-untrusted-data

MITRE

Status: PUBLISHED

Assigner: Perforce

Published: 2025-02-07T19:28:45.531Z

Updated: 2025-02-07T19:46:31.091Z

Reserved: 2021-02-09T22:41:26.424Z

Link: CVE-2021-27017

Vulnrichment

Updated: 2025-02-07T19:46:24.940Z

NVD

Status : Received

Published: 2025-02-07T20:15:31.983

Modified: 2025-02-07T20:15:31.983

Link: CVE-2021-27017

Redhat

Severity : Moderate

Publid Date: 2021-02-10T00:00:00Z

Links: CVE-2021-27017 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2021-27017", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "state": "PUBLISHED", "assignerShortName": "Perforce", "dateReserved": "2021-02-09T22:41:26.424Z", "datePublished": "2025-02-07T19:28:45.531Z", "dateUpdated": "2025-02-07T19:46:31.091Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Puppet Agent", "vendor": "PuppetPu", "versions": [{"lessThan": "7.4.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.</span><br>"}], "value": "Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-02-07T19:28:45.531Z"}, "references": [{"url": "https://www.puppet.com/security/cve/cve-2021-27017-deserialization-untrusted-data"}], "source": {"discovery": "UNKNOWN"}, "title": "Deserialization of untrusted data", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-502", "lang": "en", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-07T19:46:04.757597Z", "id": "CVE-2021-27017", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-07T19:46:31.091Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2021-27017", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-07T19:46:04.757597Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-07T19:46:24.940Z"}}], "cna": {"title": "Deserialization of untrusted data", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PuppetPu", "product": "Puppet Agent", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "7.4.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.puppet.com/security/cve/cve-2021-27017-deserialization-untrusted-data"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.</span><br>", "base64": false}]}], "providerMetadata": {"orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "shortName": "Perforce", "dateUpdated": "2025-02-07T19:28:45.531Z"}}}, "cveMetadata": {"cveId": "CVE-2021-27017", "state": "PUBLISHED", "dateUpdated": "2025-02-07T19:46:31.091Z", "dateReserved": "2021-02-09T22:41:26.424Z", "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e", "datePublished": "2025-02-07T19:28:45.531Z", "assignerShortName": "Perforce"}, "dataVersion": "5.1"}