CVE-2021-45083

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, 'koan', that integrates with cobbler. Cobbler's advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.

Security Fix(es):

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

This feature update fixes the following issues:

cobbler:

• Move configuration files ownership to apache (bsc#1195906)
• Make configuration files only readable by root (bsc#1193671, CVE-2021-45083)

golang-github-prometheus-prometheus:

• Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  • Bugfixes:
    • Scrape: Fix reporting metrics when sample limit is reached during the report. #9996
    • Scrape: Ensure that scrape interval and scrape timeout are always set. #10023
    • TSDB: Expose and fix bug in iterators' Seek() method. #10030
• Upgrade to upstream version 2.32.0
  • Change:
    • remote-write: Change default max retry time from 100ms to 5 seconds. #9634
  • Features:
    • Agent: New mode of operation optimized for remote-write only scenarios, without local storage.
    • Promtool: Add promtool check service-discovery command. #8970
  • Enhancements:
    • Promtool: Improve test output. #8064
    • Promtool: Use kahan summation for better numerical stability.
    • Remote-write: Reuse memory for marshalling. #9412
    • Scrape: Add scrape_body_size_bytes scrape metric behind the --enable-feature=extra-scrape-metrics flag. #9569
    • TSDB: Add windows arm64 support. #9703
    • TSDB: Optimize query by skipping unneeded sorting in TSDB.
    • Templates: Support int and uint as datatypes for template formatting. #9680
    • UI: Prefer rate over rad, delta over deg, and count over cos in autocomplete. #9688
    • TSDB: Add more size checks when writing individual sections in the index. #9710
    • PromQL: Make deriv() return zero values for constant series.
    • TSDB: Fix panic when checkpoint directory is empty. #9687
    • TSDB: Fix panic, out of order chunks, and race warning during WAL replay. #9856
    • UI: Correctly render links for targets with IPv6 addresses that contain a Zone ID. #9853
    • Promtool: Fix checking of authorization.credentials_file and bearer_token_file fields. #9883
    • Uyuni SD: Fix null pointer exception during initialization.
    • TSDB: Fix queries after a failed snapshot replay. #9980
• Upgrade to upstream version 2.31.1
  • Bugfix:
    • SD: Fix a panic when the experimental discovery manager receives targets during a reload. #9656
• Upgrade to upstream version 2.31.0
  • UI: Remove standard PromQL editor in favour of the codemirror-based editor. #9452
  • PromQL: Add trigonometric functions and atan2 binary operator. #9239 #9248 #9515
  • Remote: Add support for exemplar in the remote write receiver endpoint. #9319 #9414
  • SD: Add PuppetDB service discovery. #8883
  • SD: Add Uyuni service discovery. #8190
  • Web: Add support for security-related HTTP headers. #9546
  • Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  • Backfill: Add --max-block-duration in promtool create-blocks-from rules. #9511
  • Config: Print human-readable sizes with unit instead of raw numbers. #9361
  • HTTP: Re-enable HTTP/2. #9398
  • Kubernetes SD: Warn user if number of endpoints exceeds limit. #9467
  • OAuth2: Add TLS configuration to token requests. #9550
  • PromQL: Several optimizations. #9365 #9360 #9362 #9552
  • PromQL: Make aggregations deterministic in instant queries.
  • Rules: Add the ability to limit number of alerts or series.
  • SD: Experimental discovery manager to avoid restarts upon reload.
  • UI: Debounce timerange setting changes. #9359
  • Backfill: Apply rule labels after query labels. #9421
  • Scrape: Resolve conflicts between multiple exported label prefixes. #9479 #9518
  • Scrape: Restart scrape loops when scrape_interval is changed. #9551
  • TSDB: Fix memory leak in samples deletion. #9151
  • UI: Use consistent margin-bottom for all alert kinds. #9318
• Upgrade to upstream version 2.30.3
  • TSDB: Fix panic on failed snapshot replay. #9438
  • TSDB: Don't fail snapshot…

This update for cobbler fixes the following issues:

• CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).

The following non-security bugs were fixed:

• Move configuration files ownership to apache (bsc#1195906)

This update for cobbler fixes the following issues:

• CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).
• CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).

The following non-security bugs were fixed:

• Fix issues with installation module logging and validation (bsc#1195918)
• Move configuration files ownership to apache (bsc#1195906)
• Remove hardcoded test credentials (bsc#1193673)
• Prevent log pollution (bsc#1193675)
• Missing sanity check on MongoDB configuration file (bsc#1193676)

This update for cobbler fixes the following issues:

• CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).
• CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).

The following non-security bugs were fixed:

• Fix issues with installation module logging and validation (bsc#1195918)
• Move configuration files ownership to apache (bsc#1195906)
• Remove hardcoded test credentials (bsc#1193673)
• Prevent log pollution (bsc#1193675)
• Missing sanity check on MongoDB configuration file (bsc#1193676)

This update for cobbler fixes the following issues:

• CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).

The following non-security bugs were fixed:

• Move configuration files ownership to apache (bsc#1195906)

It was discovered that Cobbler did not properly handle user input, which could result in an absolute path traversal. An attacker could possibly use this issue to read arbitrary files. (CVE-2014-3225)

It was discovered that Cobbler did not properly handle user input, which could result in command injection. An attacker could possibly use this issue to execute arbitrary code with high privileges. (CVE-2017-1000469, CVE-2021-45082)

It was discovered that Cobbler did not properly hide private functions in a class. A remote attacker could possibly use this issue to gain high privileges and upload files to an arbitrary location. (CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)

Nicolas Chatelain discovered that Cobbler did not properly handle user input, which could result in log poisoning. A remote attacker could possibly use this issue to bypass authorization, write in an arbitrary file, or execute arbitrary code. (CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)

It was discovered that Cobbler did not properly handle file permissions during package install or update operations. An attacker could possibly use this issue to perform a privilege escalation attack. (CVE-2021-45083)

It was discovered that Cobbler did not properly process credentials for expired accounts. An attacker could possibly use this issue to login to the platform with an expired account or password. (CVE-2022-0860)