CVE-2017-1000469

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.

This update for cobbler fixes the following issues:

• Add cobbler-tests subpackage for unit testing for openSUSE/SLE

• Adds LoadModule definitions for openSUSE/SLE

• Switch to new refactored auth module.

• use systemctl to restart cobblerd on logfile rotation (boo#1169207) Mainline logrotate conf file uses already /sbin/service instead of outdated: /etc/init.d/cobblerd

• Fix cobbler sync for DHCP or DNS (boo#1169553) Fixed mainline by commit 2d6cfe42da

• Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (boo#1159010)

• Fix for kernel and initrd detection (boo#1159010)

• New:

  • For the distro there is now a parameter remote_boot_initrd and remote_boot_kernel ()
  • For the profile there is now a parameter filename for DHCP. (#2280)
  • Signatures for ESXi 6 and 7 (#2308)
  • The hardlink command is now detected more dynamically and thus more error resistant (#2297)
  • HTTPBoot will now work in some cases out of the bug. (#2295)
  • Additional DNS query for a case where the wrong record was queried in the nsupdate system case (#2285)

• Changes:

  • Enabled a lot of tests, removed some and implemented new. (#2202)
  • Removed not used files from the codebase. (#2302)
  • Exchanged mkisofs to xorrisofs. (#2296)
  • Removed duplicate code. (#2224)
  • Removed unreachable code. (#2223)
  • Snippet creation and deletion now works again via xmlrpc. (#2244)
  • Replace createrepo with createrepo_c. (#2266)
  • Enable Kerberos through having a case sensitive users.conf. (#2272)

• Bugfixes:

  • General various Bugfixes (#2331, )
  • Makefile usage and commands. (#2344, #2304)
  • Fix the dhcp template. (#2314)
  • Creation of the management classes and gPXE. (#2310)
  • Fix the scm_track module. (#2275, #2279)
  • Fix passing the netdevice parameter correctly to the linuxrc. (#2263)
  • powerstatus from cobbler now works thanks to a wrapper for ipmitool. (#2267)
  • In case the LDAP is used for auth, it now works with ADs. (#2274)
  • Fix passthru authentication. (#2271)

• Other:

  • Add Codecov. (#2229)
  • Documentation updates. (#2333, #2326, #2305, #2249, #2268)
  • Buildprocess:
    • Recreation and cleanup of Grub2. (#2278)
    • Fix small errors for openSUSE Leap. (#2233)
    • Fix rpmlint errors. (#2237)
    • Maximum compatibility for debbuild package creation. (#2255, #2292, #2242, #2300)
  • Fixes related to our CI Pipeline (#2254, #2269)
  • Internal Code cleanup (#2273, #2270)

• Breaking Changes:

  • Hash handling in users.digest file. (#2299)

• Updated to version 3.1.1.

  • Introduce new packaging from upstream
  • Changelog see below

• New:

  • We are now having a cross-distro specfile which can be build in the OBS (#2220) - before rewritten it was improved by #2144 & #2174
  • Grub Submenu for net-booting machines (#2217)
  • Building the Cent-OS RPMs in Docker (#2190 #2189)
  • Reintroduced manpage build in setup.py (#2185)
  • mgmt_parameters are now passed to the dhcp template (#2182)
  • Using the standard Pyhton3 logger instead of a custom one (#2160 #2139 #2151)
  • Script for converting the settings file from 3.0.0 to 3.0.1 (#2154)
  • Docs now inside the repo instead of cobbler.github.io and improved with sphinx (#2117)

• Changes:

  • The default tftpboot directory is now /var/lib/tftpboot instead of previously /srv/tftpboot (#2220)
  • Distro signatures were adjusted where necessary (#2219 #2134)
  • Removed requirements.txt and placed the requirements in setup.py (#2204)
  • Display only entries in grub which are from the same arch (#2191 #2216)
  • Change the name of the cobbler manpage form cobbler-cli to cobbler back and move it to section 8 (#2188 #2186)

• Bugfixes:

  • Incremented Version to 3.1.1 from 3.0.1
  • S390 Support was cleaned up (#2207 #2178)
  • PowerPC Support was cleaned up (#2178)
  • Added a missing import while importing a distro with cobbler import (#2201)
  • Fixed a case where a stacktrace would be…

This update for cobbler fixes the following issues:

• Add cobbler-tests subpackage for unit testing for openSUSE/SLE

• Adds LoadModule definitions for openSUSE/SLE

• Switch to new refactored auth module.

• use systemctl to restart cobblerd on logfile rotation (boo#1169207) Mainline logrotate conf file uses already /sbin/service instead of outdated: /etc/init.d/cobblerd

• Fix cobbler sync for DHCP or DNS (boo#1169553) Fixed mainline by commit 2d6cfe42da

• Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (boo#1159010)

• Fix for kernel and initrd detection (boo#1159010)

• New:

  • For the distro there is now a parameter remote_boot_initrd and remote_boot_kernel ()
  • For the profile there is now a parameter filename for DHCP. (#2280)
  • Signatures for ESXi 6 and 7 (#2308)
  • The hardlink command is now detected more dynamically and thus more error resistant (#2297)
  • HTTPBoot will now work in some cases out of the bug. (#2295)
  • Additional DNS query for a case where the wrong record was queried in the nsupdate system case (#2285)

• Changes:

  • Enabled a lot of tests, removed some and implemented new. (#2202)
  • Removed not used files from the codebase. (#2302)
  • Exchanged mkisofs to xorrisofs. (#2296)
  • Removed duplicate code. (#2224)
  • Removed unreachable code. (#2223)
  • Snippet creation and deletion now works again via xmlrpc. (#2244)
  • Replace createrepo with createrepo_c. (#2266)
  • Enable Kerberos through having a case sensitive users.conf. (#2272)

• Bugfixes:

  • General various Bugfixes (#2331, )
  • Makefile usage and commands. (#2344, #2304)
  • Fix the dhcp template. (#2314)
  • Creation of the management classes and gPXE. (#2310)
  • Fix the scm_track module. (#2275, #2279)
  • Fix passing the netdevice parameter correctly to the linuxrc. (#2263)
  • powerstatus from cobbler now works thanks to a wrapper for ipmitool. (#2267)
  • In case the LDAP is used for auth, it now works with ADs. (#2274)
  • Fix passthru authentication. (#2271)

• Other:

  • Add Codecov. (#2229)
  • Documentation updates. (#2333, #2326, #2305, #2249, #2268)
  • Buildprocess:
    • Recreation and cleanup of Grub2. (#2278)
    • Fix small errors for openSUSE Leap. (#2233)
    • Fix rpmlint errors. (#2237)
    • Maximum compatibility for debbuild package creation. (#2255, #2292, #2242, #2300)
  • Fixes related to our CI Pipeline (#2254, #2269)
  • Internal Code cleanup (#2273, #2270)

• Breaking Changes:

  • Hash handling in users.digest file. (#2299)

• Updated to version 3.1.1.

  • Introduce new packaging from upstream
  • Changelog see below

• New:

  • We are now having a cross-distro specfile which can be build in the OBS (#2220) - before rewritten it was improved by #2144 & #2174
  • Grub Submenu for net-booting machines (#2217)
  • Building the Cent-OS RPMs in Docker (#2190 #2189)
  • Reintroduced manpage build in setup.py (#2185)
  • mgmt_parameters are now passed to the dhcp template (#2182)
  • Using the standard Pyhton3 logger instead of a custom one (#2160 #2139 #2151)
  • Script for converting the settings file from 3.0.0 to 3.0.1 (#2154)
  • Docs now inside the repo instead of cobbler.github.io and improved with sphinx (#2117)

• Changes:

  • The default tftpboot directory is now /var/lib/tftpboot instead of previously /srv/tftpboot (#2220)
  • Distro signatures were adjusted where necessary (#2219 #2134)
  • Removed requirements.txt and placed the requirements in setup.py (#2204)
  • Display only entries in grub which are from the same arch (#2191 #2216)
  • Change the name of the cobbler manpage form cobbler-cli to cobbler back and move it to section 8 (#2188 #2186)

• Bugfixes:

  • Incremented Version to 3.1.1 from 3.0.1
  • S390 Support was cleaned up (#2207 #2178)
  • PowerPC Support was cleaned up (#2178)
  • Added a missing import while importing a distro with cobbler import (#2201)
  • Fixed a case where a stacktrace would be…

These are all security issues fixed in the cobbler-3.2.1.336+git.5639a3af-1.1 package on the GA media of openSUSE Tumbleweed.

This update for cobbler fixes the following issues:

The following security issue has been fixed:

• CVE-2017-1000469: Escape shell parameters provided by the user for the reposync action. (bsc#1074594)

Additionally, the following non-security issues have been fixed:

• Fix signature for SLES15. (bsc#1075014)
• Detect if there is already another instance of 'cobbler sync' running and exit with failure if so. (bsc#1081714)
• Add SLES 15 distro profile. (bsc#1090205)
• Require tftp(server) instead of atftp.

This update for cobbler fixes the following issues:

• CVE-2017-1000469: Escape shell parameters provided by the user for the reposync action. (bsc#1074594)
• Fix for calling koan with virt_type kvm. (bsc#1090205)

This update provides the following fixes and improvements for SUSE Manager Server 3.1:

The following new package has been added:

py26-compat-salt:

This package provides compatibility with Python 2.6 for salt.

This update includes the following new features:

(fate#325476)

Additonally, the following issues have been fixed:

cobbler:

• Detect if there is already another instance of 'cobbler sync' running and exit with failure if so. (bsc#1081714)
• CVE-2017-1000469: Escape shell parameters provided by the user for the reposync action. (bsc#1074594)
• Add sles15 distro profile. (bsc#1090205)

google-gson:

• Update to version 2.8.2. (bsc#1091091)

patterns-suse-manager:

• Require py26-compat-salt and python3-salt to be able to connect with salt-ssh to a system which has python2.6 or python3 installed. (fate#325476)

salt-netapi-client:

• See https://github.com/SUSE/salt-netapi-client/releases/tag/v0.14.0

spacewalk-backend:

• Do not fail boostrap if no ip6addr interface. (bsc#1090395)
• Allow again to use a higher version of spacewalk-backend-libs with spacewalk-backend. (bsc#1092383)
• SLE15 support: recommended/required flag for products and channels.

spacewalk-branding:

• Fix URL for new products page. (bsc#1092492)
• SLE15 support: recommended/required flag for products and channels.
• Show channel label when listing config channels. (bsc#1083278)

spacewalk-certs-tools:

• Fix bootstrap script for python3. (bsc#1091840)
• Support SLE15 product family.

spacewalk-java:

• Do not create new product if product_id exists, update it instead (bsc#1096714)
• Fix deletion of Taskomatic schedules via the GUI (bsc#1095569)
• Fix unknown installed products when using salt-ssh. (bsc#1088861)
• Prevent NPE when no image build history details are available. (bsc#1092161)
• Uniform the notification message when scheduling HW refresh. (bsc#1082796)
• Add SLES12 SP2 LTSS family. (bsc#1092194)
• Fix token cleanup task crashing. (bsc#1090585)
• HW refresh fails on SLE15 Salt client. (bsc#1090221)
• Only show the most relevant (least effort) solutions. (bsc#1087071)
• Add support for autoinstallation of SLE15. (bsc#1090205)
• Update sles_register cobbler snippets to work with SLE15. (bsc#1090205)
• Support SLE15 product family.
• Show channel label when listing config channels. (bsc#1083278)
• Fix equals to display channels with same name but different label. (bsc#1083278)
• Avoid init.sls files with no revision on Config State Channels. (bsc#1091855)
• Fix taskomatic deadlock in failure case. (bsc#1085471)
• Render configuration files with UTF-8. (bsc#1088667)
• Update google-gson to version 2.8.2. (bsc#1091091)
• Fix updating Subscription cache. (bsc#1075466)
• Fix NPE in websocket session configurator. (bsc#1080474)
• Wait until minion is back to set RebootAction as COMPLETED. (bsc#1089401)
• Add support for Prometheus monitoring.
• Fix constraint violation errors when onboarding. (bsc#1089468)
• Fix Advanced search for systems with installed packages. (bsc#1085838)

spacewalk-utils:

• Clone-by-date removes packages only if the list is not empty. (bsc#1089396)

spacewalk-web:

• Fix misleading message when syncing channels. (bsc#1089103)
• Automatically select mandatory channels when selecting a base channel. (bsc#1083513)
• Fix ace.js editor config to use soft tabs. (bsc#1090040)
• Display always config channel name and label. (bsc#1083278)

susemanager:

• Add missing python3 packages to bootstrap JeOS image. (bsc#1085044)
• Support SLE15 product family.
• Fix crash on not properly configured environment. (bsc#1092275)
• Provide full traditional stack in RES bootstrap repo. (bsc#1091667)
• Fix bootstrap script for python3. (bsc#1091840)
• Fix unknown installed products when using salt-ssh. (bsc#1088861)
• Add python2-salt to RES7 and SLES12 bootstrap repository.
• Fix bootstrapping RHEL 7 salt client (missing python-ipaddress). (bsc#1087055)

susemanager-frontend-libs:

• Enforce susemanager-nodejs-sdk-devel…

It was discovered that Cobbler did not properly handle user input, which could result in an absolute path traversal. An attacker could possibly use this issue to read arbitrary files. (CVE-2014-3225)

It was discovered that Cobbler did not properly handle user input, which could result in command injection. An attacker could possibly use this issue to execute arbitrary code with high privileges. (CVE-2017-1000469, CVE-2021-45082)

It was discovered that Cobbler did not properly hide private functions in a class. A remote attacker could possibly use this issue to gain high privileges and upload files to an arbitrary location. (CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)

Nicolas Chatelain discovered that Cobbler did not properly handle user input, which could result in log poisoning. A remote attacker could possibly use this issue to bypass authorization, write in an arbitrary file, or execute arbitrary code. (CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)

It was discovered that Cobbler did not properly handle file permissions during package install or update operations. An attacker could possibly use this issue to perform a privilege escalation attack. (CVE-2021-45083)

It was discovered that Cobbler did not properly process credentials for expired accounts. An attacker could possibly use this issue to login to the platform with an expired account or password. (CVE-2022-0860)