CVE-2021-40324

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.

This update for SUSE Manager 4.2.2 Release Notes provides the following additions:

Release notes for SUSE Manager:

• Update to 4.2.2
  • SUSE Manager is now able to manage Rocky Linux 8 clients
  • Tech Preview: Inter-Server Sync V2
  • Bugs mentioned bsc#1171483, bsc#1173143, bsc#1181223, bsc#1186281, bsc#1186339, bsc#1187335, bsc#1187549, bsc#1188032, bsc#1188042, bsc#1188136, bsc#1188163, bsc#1188193, bsc#1188260, bsc#1188393, bsc#1188400, bsc#1188503, bsc#1188505, bsc#1188551, bsc#1188641, bsc#1188647, bsc#1188656, bsc#1188853, bsc#1188855, bsc#1189011, bsc#1189040, bsc#1189167, bsc#1189419, bsc#1189458,
    • CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458)
    • CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)
    • CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)
      • Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded to cobbler may be rejected.

Release notes for SUSE Manager proxy:

• Update to 4.2.2
  • Bugs mentioned bsc#1181223, bsc#1186026, bsc#1188042, bsc#1189011, bsc#1189263

This update for cobbler fixes the following issues:

Security issues fixed:

• CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458)

• CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)

• CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)

• Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded to cobbler may be rejected

This update fixes the following issues:

branch-network-formula:

• Use kernel parameters from PXE formula also for local boot

cobbler - security issues fixed:

• CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458)
• CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)
• CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)
• Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded to cobbler may be rejected:

cpu-mitigations-formula:

• Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions

openvpn-formula:

• Changed package to noarch.

prometheus-exporters-formula:

• Fix formula data migration with missing exporter configuration (bsc#1188136)

py26-compat-salt:

• Fix error handling in openscap module (bsc#1188647)
• Define license macro as doc in spec file if not existing

py27-compat-salt:

• Add missing aarch64 to rpm package architectures
• Consolidate some state requisites (bsc#1188641)
• Fix failing unit test for systemd
• Fix error handling in openscap module (bsc#1188647)
• Better handling of bad public keys from minions (bsc#1189040)
• Define license macro as doc in spec file if not existing

saltboot-formula:

• Use kernel parameters from PXE formula also for local boot

spacecmd:

• Update translation strings
• Make schedule_deletearchived to get all actions without display limit
• Allow passing a date limit for schedule_deletearchived on spacecmd (bsc#1181223)
• Use correct API endpoint in list_proxies (bsc#1188042)
• Add schedule_deletearchived to bulk delete archived actions (bsc#1181223)

spacewalk-backend:

• Update translation strings
• Fix typo 'verfication' instead of 'verification'

spacewalk-certs-tools:

• Prepare the bootstrap script generator for Rocky Linux 8

spacewalk-client-tools:

• Update translation strings

spacewalk-java:

• Show AppStreams tab just for modular channels
• Fix Json null comparison in virtual network info parsing (bsc#1189167)
• Update translation strings
• 'AppStreams with defaults' filter template in CLM
• Add a link to OS image store dir in image list page
• Do not log XMLRPC fault exceptions as errors (bsc#1188853)
• XMLRPC: Add call for listing application monitoring endpoints
• AppStreams tab for modular channels
• Link to CLM filter creation from system details page
• Allow getting all archived actions via XMLRPC without display limit (bsc#1181223)
• Fix NPE when no redhat info could be fetched
• Java enablement for Rocky Linux 8
• Delete ActionChains when the last action is a Reboot and it completes (bsc#1188163)
• Properly handle virtual networks without defined bridge (bsc#1189167)
• Mark SSH minion actions when they're picked up (bsc#1188505)
• Add UEFI support for VM creation / editing
• Add virt-tuner templates to VM creation
• Fix cleanup always being executed on delete system (bsc#1189011)
• Warning in Overview page for SLE Micro system (bsc#1188551)
• Add support for Kiwi options
• Ensure XMLRPC returns 'issue_date' in ISO format when listing erratas (bsc#1188260)
• Fix NullPointerException in HardwareMapper.getUpdatedGuestMemory
• Fix entitlements not being updated during system transfer (bsc#1188032)
• Simplify the VM creation action in DB
• Get CPU data for AArch64
• Handle virtual machines running on pacemaker cluster
• Refresh virtual host pillar to clear the virtpoller beacon (bsc#1188393)
• Add Beijing timezone to selectable timezones (bsc#1188193)
• Fix updating primary net interface on hardware refresh (bsc#1188400)
• Fix issues when removing archived actions using XMLRPC api (bsc#1181223)
• Readable error when 'mgr-sync add channel' is called with a no-existing label (bsc#1173143)

spacewalk-setup:

• Enable logging for salt SSH
• Increase max size for uploaded files to Salt master

spacewalk-utils:

• Add Rocky Linux 8 repositories

spacewalk-web:

• Don't capitalize acronyms
• Update translation strings
• 'AppStreams with…

It was discovered that Cobbler did not properly handle user input, which could result in an absolute path traversal. An attacker could possibly use this issue to read arbitrary files. (CVE-2014-3225)

It was discovered that Cobbler did not properly handle user input, which could result in command injection. An attacker could possibly use this issue to execute arbitrary code with high privileges. (CVE-2017-1000469, CVE-2021-45082)

It was discovered that Cobbler did not properly hide private functions in a class. A remote attacker could possibly use this issue to gain high privileges and upload files to an arbitrary location. (CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)

Nicolas Chatelain discovered that Cobbler did not properly handle user input, which could result in log poisoning. A remote attacker could possibly use this issue to bypass authorization, write in an arbitrary file, or execute arbitrary code. (CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)

It was discovered that Cobbler did not properly handle file permissions during package install or update operations. An attacker could possibly use this issue to perform a privilege escalation attack. (CVE-2021-45083)

It was discovered that Cobbler did not properly process credentials for expired accounts. An attacker could possibly use this issue to login to the platform with an expired account or password. (CVE-2022-0860)