CVE-2018-1000225

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).

This update for cobbler fixes the following issues:

• Add cobbler-tests subpackage for unit testing for openSUSE/SLE

• Adds LoadModule definitions for openSUSE/SLE

• Switch to new refactored auth module.

• use systemctl to restart cobblerd on logfile rotation (boo#1169207) Mainline logrotate conf file uses already /sbin/service instead of outdated: /etc/init.d/cobblerd

• Fix cobbler sync for DHCP or DNS (boo#1169553) Fixed mainline by commit 2d6cfe42da

• Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (boo#1159010)

• Fix for kernel and initrd detection (boo#1159010)

• New:

  • For the distro there is now a parameter remote_boot_initrd and remote_boot_kernel ()
  • For the profile there is now a parameter filename for DHCP. (#2280)
  • Signatures for ESXi 6 and 7 (#2308)
  • The hardlink command is now detected more dynamically and thus more error resistant (#2297)
  • HTTPBoot will now work in some cases out of the bug. (#2295)
  • Additional DNS query for a case where the wrong record was queried in the nsupdate system case (#2285)

• Changes:

  • Enabled a lot of tests, removed some and implemented new. (#2202)
  • Removed not used files from the codebase. (#2302)
  • Exchanged mkisofs to xorrisofs. (#2296)
  • Removed duplicate code. (#2224)
  • Removed unreachable code. (#2223)
  • Snippet creation and deletion now works again via xmlrpc. (#2244)
  • Replace createrepo with createrepo_c. (#2266)
  • Enable Kerberos through having a case sensitive users.conf. (#2272)

• Bugfixes:

  • General various Bugfixes (#2331, )
  • Makefile usage and commands. (#2344, #2304)
  • Fix the dhcp template. (#2314)
  • Creation of the management classes and gPXE. (#2310)
  • Fix the scm_track module. (#2275, #2279)
  • Fix passing the netdevice parameter correctly to the linuxrc. (#2263)
  • powerstatus from cobbler now works thanks to a wrapper for ipmitool. (#2267)
  • In case the LDAP is used for auth, it now works with ADs. (#2274)
  • Fix passthru authentication. (#2271)

• Other:

  • Add Codecov. (#2229)
  • Documentation updates. (#2333, #2326, #2305, #2249, #2268)
  • Buildprocess:
    • Recreation and cleanup of Grub2. (#2278)
    • Fix small errors for openSUSE Leap. (#2233)
    • Fix rpmlint errors. (#2237)
    • Maximum compatibility for debbuild package creation. (#2255, #2292, #2242, #2300)
  • Fixes related to our CI Pipeline (#2254, #2269)
  • Internal Code cleanup (#2273, #2270)

• Breaking Changes:

  • Hash handling in users.digest file. (#2299)

• Updated to version 3.1.1.

  • Introduce new packaging from upstream
  • Changelog see below

• New:

  • We are now having a cross-distro specfile which can be build in the OBS (#2220) - before rewritten it was improved by #2144 & #2174
  • Grub Submenu for net-booting machines (#2217)
  • Building the Cent-OS RPMs in Docker (#2190 #2189)
  • Reintroduced manpage build in setup.py (#2185)
  • mgmt_parameters are now passed to the dhcp template (#2182)
  • Using the standard Pyhton3 logger instead of a custom one (#2160 #2139 #2151)
  • Script for converting the settings file from 3.0.0 to 3.0.1 (#2154)
  • Docs now inside the repo instead of cobbler.github.io and improved with sphinx (#2117)

• Changes:

  • The default tftpboot directory is now /var/lib/tftpboot instead of previously /srv/tftpboot (#2220)
  • Distro signatures were adjusted where necessary (#2219 #2134)
  • Removed requirements.txt and placed the requirements in setup.py (#2204)
  • Display only entries in grub which are from the same arch (#2191 #2216)
  • Change the name of the cobbler manpage form cobbler-cli to cobbler back and move it to section 8 (#2188 #2186)

• Bugfixes:

  • Incremented Version to 3.1.1 from 3.0.1
  • S390 Support was cleaned up (#2207 #2178)
  • PowerPC Support was cleaned up (#2178)
  • Added a missing import while importing a distro with cobbler import (#2201)
  • Fixed a case where a stacktrace would be…

This update for cobbler fixes the following issues:

• Add cobbler-tests subpackage for unit testing for openSUSE/SLE

• Adds LoadModule definitions for openSUSE/SLE

• Switch to new refactored auth module.

• use systemctl to restart cobblerd on logfile rotation (boo#1169207) Mainline logrotate conf file uses already /sbin/service instead of outdated: /etc/init.d/cobblerd

• Fix cobbler sync for DHCP or DNS (boo#1169553) Fixed mainline by commit 2d6cfe42da

• Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (boo#1159010)

• Fix for kernel and initrd detection (boo#1159010)

• New:

  • For the distro there is now a parameter remote_boot_initrd and remote_boot_kernel ()
  • For the profile there is now a parameter filename for DHCP. (#2280)
  • Signatures for ESXi 6 and 7 (#2308)
  • The hardlink command is now detected more dynamically and thus more error resistant (#2297)
  • HTTPBoot will now work in some cases out of the bug. (#2295)
  • Additional DNS query for a case where the wrong record was queried in the nsupdate system case (#2285)

• Changes:

  • Enabled a lot of tests, removed some and implemented new. (#2202)
  • Removed not used files from the codebase. (#2302)
  • Exchanged mkisofs to xorrisofs. (#2296)
  • Removed duplicate code. (#2224)
  • Removed unreachable code. (#2223)
  • Snippet creation and deletion now works again via xmlrpc. (#2244)
  • Replace createrepo with createrepo_c. (#2266)
  • Enable Kerberos through having a case sensitive users.conf. (#2272)

• Bugfixes:

  • General various Bugfixes (#2331, )
  • Makefile usage and commands. (#2344, #2304)
  • Fix the dhcp template. (#2314)
  • Creation of the management classes and gPXE. (#2310)
  • Fix the scm_track module. (#2275, #2279)
  • Fix passing the netdevice parameter correctly to the linuxrc. (#2263)
  • powerstatus from cobbler now works thanks to a wrapper for ipmitool. (#2267)
  • In case the LDAP is used for auth, it now works with ADs. (#2274)
  • Fix passthru authentication. (#2271)

• Other:

  • Add Codecov. (#2229)
  • Documentation updates. (#2333, #2326, #2305, #2249, #2268)
  • Buildprocess:
    • Recreation and cleanup of Grub2. (#2278)
    • Fix small errors for openSUSE Leap. (#2233)
    • Fix rpmlint errors. (#2237)
    • Maximum compatibility for debbuild package creation. (#2255, #2292, #2242, #2300)
  • Fixes related to our CI Pipeline (#2254, #2269)
  • Internal Code cleanup (#2273, #2270)

• Breaking Changes:

  • Hash handling in users.digest file. (#2299)

• Updated to version 3.1.1.

  • Introduce new packaging from upstream
  • Changelog see below

• New:

  • We are now having a cross-distro specfile which can be build in the OBS (#2220) - before rewritten it was improved by #2144 & #2174
  • Grub Submenu for net-booting machines (#2217)
  • Building the Cent-OS RPMs in Docker (#2190 #2189)
  • Reintroduced manpage build in setup.py (#2185)
  • mgmt_parameters are now passed to the dhcp template (#2182)
  • Using the standard Pyhton3 logger instead of a custom one (#2160 #2139 #2151)
  • Script for converting the settings file from 3.0.0 to 3.0.1 (#2154)
  • Docs now inside the repo instead of cobbler.github.io and improved with sphinx (#2117)

• Changes:

  • The default tftpboot directory is now /var/lib/tftpboot instead of previously /srv/tftpboot (#2220)
  • Distro signatures were adjusted where necessary (#2219 #2134)
  • Removed requirements.txt and placed the requirements in setup.py (#2204)
  • Display only entries in grub which are from the same arch (#2191 #2216)
  • Change the name of the cobbler manpage form cobbler-cli to cobbler back and move it to section 8 (#2188 #2186)

• Bugfixes:

  • Incremented Version to 3.1.1 from 3.0.1
  • S390 Support was cleaned up (#2207 #2178)
  • PowerPC Support was cleaned up (#2178)
  • Added a missing import while importing a distro with cobbler import (#2201)
  • Fixed a case where a stacktrace would be…

These are all security issues fixed in the cobbler-3.2.1.336+git.5639a3af-1.1 package on the GA media of openSUSE Tumbleweed.

This update for the SUSE Manager 3.0 Release Notes provides the following additions:

• SUSE Manager Server bugs fixed by latest updates

  • bsc#1057635, bsc#1083295, bsc#1087837, bsc#1089362, bsc#1089526, bsc#1089662, bsc#1093458, bsc#1096264, bsc#1096514, bsc#1097250, bsc#1097697, bsc#1098388, bsc#1098394, bsc#1098815, bsc#1098993, bsc#1099583, bsc#1099638, bsc#1099781, bsc#1100131, bsc#1100731, bsc#1101670, bsc#1102009, bsc#1103044, bsc#1103090, bsc#1103218, bsc#1104025, bsc#1104503, bsc#1105440, bsc#1105442

• SUSE Manager Server security issues fixed by latest updates

  • CVE-2018-1000225, CVE-2018-1000226, CVE-2018-9159

• SUSE Manager Proxy bugs fixed by latest updates

  • bsc#1083295, bsc#1094705, bsc#1097697

This update for cobbler fixes the following issues:

Security issues fixed:

• Forbid exposure of private methods in the API (CVE-2018-10931, CVE-2018-1000225, bsc#1104287, bsc#1104189, bsc#1105442)
• Check access token when calling 'modify_setting' API endpoint (bsc#1104190, bsc#1105440, CVE-2018-1000226)

Other bugs fixed:

• Fix kernel options when generating bootiso (bsc#1101670)

This update for cobbler fixes the following issues:

Security issues fixed:

• Forbid exposure of private methods in the API (CVE-2018-10931, CVE-2018-1000225, bsc#1104287, bsc#1104189, bsc#1105442)
• Check access token when calling 'modify_setting' API endpoint (bsc#1104190, bsc#1105440, CVE-2018-1000226)

Other bugs fixed:

• Do not try to hardlink to a symlink. The result will be a dangling symlink in the general case. (bsc#1097733)
• fix kernel options when generating bootiso (bsc#1101670)

This update for cobbler fixes the following issues:

Security issues fixed:

• Forbid exposure of private methods in the API (CVE-2018-10931, CVE-2018-1000225, bsc#1104287, bsc#1104189, bsc#1105442)
• Check access token when calling 'modify_setting' API endpoint (bsc#1104190, bsc#1105440, CVE-2018-1000226)

Other bugs fixed:

• Fix kernel options when generating bootiso (bsc#1101670)

It was discovered that Cobbler did not properly handle user input, which could result in an absolute path traversal. An attacker could possibly use this issue to read arbitrary files. (CVE-2014-3225)

It was discovered that Cobbler did not properly handle user input, which could result in command injection. An attacker could possibly use this issue to execute arbitrary code with high privileges. (CVE-2017-1000469, CVE-2021-45082)

It was discovered that Cobbler did not properly hide private functions in a class. A remote attacker could possibly use this issue to gain high privileges and upload files to an arbitrary location. (CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)

Nicolas Chatelain discovered that Cobbler did not properly handle user input, which could result in log poisoning. A remote attacker could possibly use this issue to bypass authorization, write in an arbitrary file, or execute arbitrary code. (CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)

It was discovered that Cobbler did not properly handle file permissions during package install or update operations. An attacker could possibly use this issue to perform a privilege escalation attack. (CVE-2021-45083)

It was discovered that Cobbler did not properly process credentials for expired accounts. An attacker could possibly use this issue to login to the platform with an expired account or password. (CVE-2022-0860)