CVE-2012-2395

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

A Command Injection in action_power.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

A Command Injection in action_power.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

This update for cobbler fixes the following issues:

• Add cobbler-tests subpackage for unit testing for openSUSE/SLE

• Adds LoadModule definitions for openSUSE/SLE

• Switch to new refactored auth module.

• use systemctl to restart cobblerd on logfile rotation (boo#1169207) Mainline logrotate conf file uses already /sbin/service instead of outdated: /etc/init.d/cobblerd

• Fix cobbler sync for DHCP or DNS (boo#1169553) Fixed mainline by commit 2d6cfe42da

• Signatures file now uses 'default_autoinstall' which fixes import problem happening with some distributions (boo#1159010)

• Fix for kernel and initrd detection (boo#1159010)

• New:

  • For the distro there is now a parameter remote_boot_initrd and remote_boot_kernel ()
  • For the profile there is now a parameter filename for DHCP. (#2280)
  • Signatures for ESXi 6 and 7 (#2308)
  • The hardlink command is now detected more dynamically and thus more error resistant (#2297)
  • HTTPBoot will now work in some cases out of the bug. (#2295)
  • Additional DNS query for a case where the wrong record was queried in the nsupdate system case (#2285)

• Changes:

  • Enabled a lot of tests, removed some and implemented new. (#2202)
  • Removed not used files from the codebase. (#2302)
  • Exchanged mkisofs to xorrisofs. (#2296)
  • Removed duplicate code. (#2224)
  • Removed unreachable code. (#2223)
  • Snippet creation and deletion now works again via xmlrpc. (#2244)
  • Replace createrepo with createrepo_c. (#2266)
  • Enable Kerberos through having a case sensitive users.conf. (#2272)

• Bugfixes:

  • General various Bugfixes (#2331, )
  • Makefile usage and commands. (#2344, #2304)
  • Fix the dhcp template. (#2314)
  • Creation of the management classes and gPXE. (#2310)
  • Fix the scm_track module. (#2275, #2279)
  • Fix passing the netdevice parameter correctly to the linuxrc. (#2263)
  • powerstatus from cobbler now works thanks to a wrapper for ipmitool. (#2267)
  • In case the LDAP is used for auth, it now works with ADs. (#2274)
  • Fix passthru authentication. (#2271)

• Other:

  • Add Codecov. (#2229)
  • Documentation updates. (#2333, #2326, #2305, #2249, #2268)
  • Buildprocess:
    • Recreation and cleanup of Grub2. (#2278)
    • Fix small errors for openSUSE Leap. (#2233)
    • Fix rpmlint errors. (#2237)
    • Maximum compatibility for debbuild package creation. (#2255, #2292, #2242, #2300)
  • Fixes related to our CI Pipeline (#2254, #2269)
  • Internal Code cleanup (#2273, #2270)

• Breaking Changes:

  • Hash handling in users.digest file. (#2299)

• Updated to version 3.1.1.

  • Introduce new packaging from upstream
  • Changelog see below

• New:

  • We are now having a cross-distro specfile which can be build in the OBS (#2220) - before rewritten it was improved by #2144 & #2174
  • Grub Submenu for net-booting machines (#2217)
  • Building the Cent-OS RPMs in Docker (#2190 #2189)
  • Reintroduced manpage build in setup.py (#2185)
  • mgmt_parameters are now passed to the dhcp template (#2182)
  • Using the standard Pyhton3 logger instead of a custom one (#2160 #2139 #2151)
  • Script for converting the settings file from 3.0.0 to 3.0.1 (#2154)
  • Docs now inside the repo instead of cobbler.github.io and improved with sphinx (#2117)

• Changes:

  • The default tftpboot directory is now /var/lib/tftpboot instead of previously /srv/tftpboot (#2220)
  • Distro signatures were adjusted where necessary (#2219 #2134)
  • Removed requirements.txt and placed the requirements in setup.py (#2204)
  • Display only entries in grub which are from the same arch (#2191 #2216)
  • Change the name of the cobbler manpage form cobbler-cli to cobbler back and move it to section 8 (#2188 #2186)

• Bugfixes:

  • Incremented Version to 3.1.1 from 3.0.1
  • S390 Support was cleaned up (#2207 #2178)
  • PowerPC Support was cleaned up (#2178)
  • Added a missing import while importing a distro with cobbler import (#2201)
  • Fixed a case where a stacktrace would be…