{"id":"CVE-2012-2395","aliases":["EUVD-2022-3869","GHSA-g34c-mg6m-xvxj","PYSEC-2026-792","RHSA-2012:1060","UBUNTU-CVE-2012-2395","openSUSE-SU-2021:0046-1","openSUSE-SU-2021:0058-1","openSUSE-SU-2024:10282-1"],"status":"published","title":"Cobbler subject to Command Injection","description":"Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05538,"percentile":0.92881,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2012-06-16T00:00:00Z","modified":"2026-07-07T11:56:31Z","fixes":[{"ecosystem":"PyPI","package":"cobbler","fixed_in":["2.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el5","package":"cobbler","fixed_in":["0:2.0.7-14.6.el5sat"],"sources":["osv"]},{"ecosystem":"Red Hat:network_satellite:5.4::el6","package":"cobbler","fixed_in":["0:2.0.7-14.6.el6sat"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}],"versions":["0.6.3-2"]},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0"}]}],"versions":["0.6.3-2"]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el5","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.7-14.6.el5sat"}]}]},{"source":"osv","ecosystem":"Red Hat:network_satellite:5.4::el6","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.7-14.6.el6sat"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-lp152.6.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-bp152.4.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-4.2"}]}],"bundled":2}],"products":[{"vendor":"michael_dehaan","product":"cobbler"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.openwall.com/lists/oss-security/2012/05/23/4","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"http://www.securityfocus.com/bid/53666","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://github.com/cobbler/cobbler/commit/6d9167e5da44eca56bdf42b5776097a6779aaadf","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/05/23/18","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/cobbler/+bug/978999","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://github.com/cobbler/cobbler/issues/141","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00016.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://www.osvdb.org/82458","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2395","tags":["advisory"]},{"url":"https://web.archive.org/web/20120712025653/http://www.securityfocus.com/bid/53666","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2012-05/msg00016.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-security-announce/2012-07/msg00000.html","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2012/05/23/18","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2012/05/23/4","tags":["web"]},{"url":"https://www.osvdb.org/82458","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g34c-mg6m-xvxj","tags":["advisory"]},{"url":"https://github.com/cobbler/cobbler","tags":["package"]},{"url":"https://pypi.org/project/cobbler","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2012:1060","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=824460","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1060.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-2395","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-2395","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2012-2395","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2012/05/23","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KL7UG4FHNZKUU44UQUG34HXRAOJ27FI2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1020376","tags":["report"]},{"url":"https://bugzilla.suse.com/1029276","tags":["report"]},{"url":"https://bugzilla.suse.com/1048183","tags":["report"]},{"url":"https://bugzilla.suse.com/1074594","tags":["report"]},{"url":"https://bugzilla.suse.com/1075014","tags":["report"]},{"url":"https://bugzilla.suse.com/1081714","tags":["report"]},{"url":"https://bugzilla.suse.com/1081739","tags":["report"]},{"url":"https://bugzilla.suse.com/1090205","tags":["report"]},{"url":"https://bugzilla.suse.com/1097733","tags":["report"]},{"url":"https://bugzilla.suse.com/1101670","tags":["report"]},{"url":"https://bugzilla.suse.com/1104189","tags":["report"]},{"url":"https://bugzilla.suse.com/1104190","tags":["report"]},{"url":"https://bugzilla.suse.com/1104287","tags":["report"]},{"url":"https://bugzilla.suse.com/1105440","tags":["report"]},{"url":"https://bugzilla.suse.com/1105442","tags":["report"]},{"url":"https://bugzilla.suse.com/1113747","tags":["report"]},{"url":"https://bugzilla.suse.com/1128754","tags":["report"]},{"url":"https://bugzilla.suse.com/1128926","tags":["report"]},{"url":"https://bugzilla.suse.com/1130658","tags":["report"]},{"url":"https://bugzilla.suse.com/1134588","tags":["report"]},{"url":"https://bugzilla.suse.com/1149075","tags":["report"]},{"url":"https://bugzilla.suse.com/1151875","tags":["report"]},{"url":"https://bugzilla.suse.com/1156574","tags":["report"]},{"url":"https://bugzilla.suse.com/1159010","tags":["report"]},{"url":"https://bugzilla.suse.com/1169207","tags":["report"]},{"url":"https://bugzilla.suse.com/1169553","tags":["report"]},{"url":"https://bugzilla.suse.com/1169779","tags":["report"]},{"url":"https://bugzilla.suse.com/1170462","tags":["report"]},{"url":"https://bugzilla.suse.com/660126","tags":["report"]},{"url":"https://bugzilla.suse.com/671212","tags":["report"]},{"url":"https://bugzilla.suse.com/672471","tags":["report"]},{"url":"https://bugzilla.suse.com/682665","tags":["report"]},{"url":"https://bugzilla.suse.com/687891","tags":["report"]},{"url":"https://bugzilla.suse.com/695955","tags":["report"]},{"url":"https://bugzilla.suse.com/714618","tags":["report"]},{"url":"https://bugzilla.suse.com/722443","tags":["report"]},{"url":"https://bugzilla.suse.com/722445","tags":["report"]},{"url":"https://bugzilla.suse.com/757062","tags":["report"]},{"url":"https://bugzilla.suse.com/763610","tags":["report"]},{"url":"https://bugzilla.suse.com/783671","tags":["report"]},{"url":"https://bugzilla.suse.com/790545","tags":["report"]},{"url":"https://bugzilla.suse.com/796773","tags":["report"]},{"url":"https://bugzilla.suse.com/811025","tags":["report"]},{"url":"https://bugzilla.suse.com/812948","tags":["report"]},{"url":"https://bugzilla.suse.com/842699","tags":["report"]},{"url":"https://bugzilla.suse.com/846580","tags":["report"]},{"url":"https://bugzilla.suse.com/869371","tags":["report"]},{"url":"https://bugzilla.suse.com/884051","tags":["report"]},{"url":"https://bugzilla.suse.com/924118","tags":["report"]},{"url":"https://bugzilla.suse.com/952844","tags":["report"]},{"url":"https://bugzilla.suse.com/956264","tags":["report"]},{"url":"https://bugzilla.suse.com/966622","tags":["report"]},{"url":"https://bugzilla.suse.com/966841","tags":["report"]},{"url":"https://bugzilla.suse.com/967523","tags":["report"]},{"url":"https://bugzilla.suse.com/968406","tags":["report"]},{"url":"https://bugzilla.suse.com/969538","tags":["report"]},{"url":"https://bugzilla.suse.com/969541","tags":["report"]},{"url":"https://bugzilla.suse.com/973413","tags":["report"]},{"url":"https://bugzilla.suse.com/973418","tags":["report"]},{"url":"https://bugzilla.suse.com/976826","tags":["report"]},{"url":"https://bugzilla.suse.com/980577","tags":["report"]},{"url":"https://bugzilla.suse.com/984998","tags":["report"]},{"url":"https://bugzilla.suse.com/986978","tags":["report"]},{"url":"https://bugzilla.suse.com/988889","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10931","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RMYIPRTLRGECRYU5WNXDNCYJJGURZSTT/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3225","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2012-2395","description":"Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","status":"published","published":"2012-06-16T00:00:00Z","modified":"2024-08-06T19:34:24.283Z","updated_at":"2026-11-02T14:34:49.937255Z"}],"euvd":[{"id":"EUVD-2022-3869","description":"Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","status":"published","published":"2012-06-16T00:00:00Z","modified":"2024-08-06T19:34:24Z","updated_at":"2026-11-03T01:56:14.434498Z"}],"ghsa":[{"id":"GHSA-g34c-mg6m-xvxj","title":"Cobbler subject to Command Injection","description":"A Command Injection in action_power.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","status":"published","published":"2022-05-17T05:27:39Z","modified":"2023-02-13T16:50:32Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:44.81167Z"}],"nvd":[{"id":"CVE-2012-2395","description":"Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","status":"published","published":"2012-06-16T00:55:07.31Z","modified":"2026-06-16T23:41:28.883Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:14.336529Z"}],"osv":[{"id":"GHSA-g34c-mg6m-xvxj","title":"Cobbler subject to Command Injection","description":"A Command Injection in action_power.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","status":"published","published":"2022-05-17T05:27:39Z","modified":"2026-07-07T11:56:31.954834314Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"openSUSE-SU-2021:0046-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- Add cobbler-tests subpackage for unit testing for openSUSE/SLE \n- Adds LoadModule definitions for openSUSE/SLE\n- Switch to new refactored auth module.\n\n- use systemctl to restart cobblerd on logfile rotation (boo#1169207)\n  Mainline logrotate conf file uses already /sbin/service instead of\n  outdated: /etc/init.d/cobblerd\n- Fix cobbler sync for DHCP or DNS (boo#1169553)\n  Fixed mainline by commit 2d6cfe42da\n- Signatures file now uses 'default_autoinstall' which fixes import\n  problem happening with some distributions (boo#1159010)\n  \n- Fix for kernel and initrd detection (boo#1159010)\n\n- New:\n  * For the distro there is now a parameter remote_boot_initrd and remote_boot_kernel ()\n  * For the profile there is now a parameter filename for DHCP. (#2280)\n  * Signatures for ESXi 6 and 7 (#2308)\n  * The hardlink command is now detected more dynamically and thus more error resistant (#2297)\n  * HTTPBoot will now work in some cases out of the bug. (#2295)\n  * Additional DNS query for a case where the wrong record was queried in the nsupdate system case (#2285)\n- Changes:\n  * Enabled a lot of tests, removed some and implemented new. (#2202)\n  * Removed not used files from the codebase. (#2302)\n  * Exchanged mkisofs to xorrisofs. (#2296)\n  * Removed duplicate code. (#2224)\n  * Removed unreachable code. (#2223)\n  * Snippet creation and deletion now works again via xmlrpc. (#2244)\n  * Replace createrepo with createrepo_c. (#2266)\n  * Enable Kerberos through having a case sensitive users.conf. (#2272)\n- Bugfixes:\n  * General various Bugfixes (#2331, )\n  * Makefile usage and commands. (#2344, #2304)\n  * Fix the dhcp template. (#2314)\n  * Creation of the management classes and gPXE. (#2310)\n  * Fix the scm_track module. (#2275, #2279)\n  * Fix passing the netdevice parameter correctly to the linuxrc. (#2263)\n  * powerstatus from cobbler now works thanks to a wrapper for ipmitool. (#2267)\n  * In case the LDAP is used for auth, it now works with ADs. (#2274)\n  * Fix passthru authentication. (#2271)\n- Other:\n  * Add Codecov. (#2229)\n  * Documentation updates. (#2333, #2326, #2305, #2249, #2268)\n  * Buildprocess:\n    *  Recreation and cleanup of Grub2. (#2278)\n    *  Fix small errors for openSUSE Leap. (#2233)\n    *  Fix rpmlint errors. (#2237)\n    *  Maximum compatibility for debbuild package creation. (#2255, #2292, #2242, #2300)\n  * Fixes related to our CI Pipeline (#2254, #2269)\n  * Internal Code cleanup (#2273, #2270)\n- Breaking Changes:\n  * Hash handling in users.digest file. (#2299) \n\n- Updated to version 3.1.1.\n  * Introduce new packaging from upstream\n  * Changelog see below\n- New:\n  * We are now having a cross-distro specfile which can be build in the OBS\n    (#2220) - before rewritten it was improved by #2144 \u0026 #2174\n  * Grub Submenu for net-booting machines (#2217)\n  * Building the Cent-OS RPMs in Docker (#2190 #2189)\n  * Reintroduced manpage build in setup.py (#2185)\n  * mgmt_parameters are now passed to the dhcp template (#2182)\n  * Using the standard Pyhton3 logger instead of a custom one (#2160 #2139 #2151)\n  * Script for converting the settings file from 3.0.0 to 3.0.1 (#2154)\n  * Docs now inside the repo instead of cobbler.github.io and improved with sphinx (#2117)\n- Changes:\n  * The default tftpboot directory is now /var/lib/tftpboot instead of previously /srv/tftpboot (#2220)\n  * Distro signatures were adjusted where necessary (#2219 #2134)\n  * Removed requirements.txt and placed the requirements in setup.py (#2204)\n  * Display only entries in grub which are from the same arch (#2191 #2216)\n  * Change the name of the cobbler manpage form cobbler-cli to cobbler back and move it to section 8 (#2188 #2186)\n- Bugfixes:\n  * Incremented Version to 3.1.1 from 3.0.1\n  * S390 Support was cleaned up (#2207 #2178)\n  * PowerPC Support was cleaned up (#2178)\n  * Added a missing import while importing a distro with cobbler import (#2201)\n  * Fixed a case where a stacktrace would be produced so pass none instead (#2203)\n  * Rename of suse_kopts_textmode_overwrite to kops_overwrite to utils (#2143 #2200)\n  * Fix rsync subprocess call (#2199 #2179)\n  * Fixed an error where the template rendering did not work (#2176)\n  * Fixed some cobbler import errors (#2172)\n  * Wrong shebang in various scripts (#2148)\n  * Fix some imports which fixes errors introduced by the remodularization (#2150 #2153)\n- Other:\n  * Issue Templates for Github (#2187)\n\n- Update to latest git HEAD code base\n  This version (from mainline so for quite a while already)\n  also includes fixes for 'boo#1149075' and boo#1151875\n\n- Fix for cobbler import and buildiso (boo#1156574)\n- Adjusted manpage creation (needs sphinx as BuildRequires)\n- Fix cobbler sync for dhcp and dns enabled due to latest module\n  renaming patches\n\n- Update to latest git HEAD\n   - Fixes permission denied in apache2 context when trying to write\n     cobbler log\n   - Fixes a bad import in import_signature (item)\n   - Fixes bad shebang bash path in mkgrub.sh (used in post section)\n\n- Now track Github master branch\n  WARNING: This release contains breaking changes for your settings file! \n  * Notable changes:\n    - Now using standard python logger\n    - Updated dhcpd.template \n- Removed fix_shebang.patch: now in upstream. \n- added -s parameter to fdupes call to prevent hardlink across \n  partititons\n\n- Update to latest v3.0.0 cobbler release\n- Add previouly added patch: exclude_get-loaders_command.patch to\n  the list of patches to apply.\n\n- Fix log file world readable (as suggested by Matthias Gerstner)\n  and change file attributes via attr in spec file\n- Do not allow get-loaders command (download of third party\n  provided network boot loaders we do not trust)\n- Mainline fixes:\n  3172d1df9b9cc8 Add missing help text in redhat_management_key field\n  c8f5490e507a72 Set default interface if cobbler system add has no\n                 --interface= param\n  31a1aa31d26c4a Remove apache IfVersion tags from apache configs\n\n- Integrated fixes that came in from mainline from other products\n  (to calm down obs regression checker):\n  CVE-2011-4953, fate#312397, boo#660126, boo#671212, boo#672471, boo#682665\n  boo#687891, boo#695955, boo#722443, boo#722445, boo#757062, boo#763610\n  boo#783671, boo#790545, boo#796773, boo#811025, boo#812948, boo#842699\n  boo#846580, boo#869371, boo#884051, boo#976826, boo#984998\n  Some older bugs need boo# references as well:\n  boo#660126, boo#671212, boo#672471, boo#682665\n  boo#687891, boo#695955, boo#722443, boo#722445, boo#757062, boo#763610\n  boo#783671, boo#790545, boo#796773, boo#811025, boo#812948, boo#842699\n  boo#846580, boo#869371, boo#884051\n\n- Fix for redhat_management_key not being listed as a choice\n  during profile rename (boo#1134588)\n- Added:\n  * rhn-mngmnt-key-field-fix.diff\n\n- Fixes distribution detection in setup.py for SLESo\n- Added:\n  * changes-detection-to-distro-like-for-suse-distributions.diff\n\n- Moving to pytest and adding Docker test integration\n- Added:\n  * add-docker-integration-testing.diff\n  * refactor-unittest-to-pytest.diff\n\n- Additional compatability changes for old Koan versions.\n- Modified:\n  * renamed-methods-alias-part2.patch\n\n- Old Koan versions not only need method aliases, but also need\n  compatible responses\n- Added:\n  * renamed-methods-alias-part2.patch\n\n- Add the redhat_managment_* fields again to enable templating in SUMA.\n- Added:\n  * revert-redhat-management-removal.patch  \n\n- Changes return of last_modified_time RPC to float\n- Added:\n  * changes-return-to-float.diff\n\n- provide old name aliases for all renamed methods:\n  - get_distro_for_koan     =\u003e  get_distro_as_rendered\n  - get_profile_for_koan    =\u003e  get_profile_as_rendered\n  - get_system_for_koan     =\u003e  get_system_as_rendered\n  - get_repo_for_koan       =\u003e  get_repo_as_rendered\n  - get_image_for_koan      =\u003e  get_image_as_rendered\n  - get_mgmtclass_for_koan  =\u003e  get_mgmtclass_as_rendered\n  - get_package_for_koan    =\u003e  get_package_as_rendered\n  - get_file_for_koan       =\u003e  get_file_as_rendered\n- Renamed:\n  get_system_for_koan.patch =\u003e renamed-methods-alias.patch\n\n- provide renamed method 'get_system_for_koan' under old name\n  for old clients.\n- Added:\n  * get_system_for_koan.patch\n\n- Bring back power_system method in the XML-RPC API\n- Changed lanplus option to lanplus=true in fence_ipmitool.template\n- Added:\n  * power_system_xmlrpc_api.patch\n- Changed:\n  * fence_ipmitool.template\n\n- Disables nsupdate_enabled by default\n- Added:\n  * disable_nsupdate_enabled_by_default.diff\n\n- Fixes issue in distribution detection with 'lower' function call.\n- Modified:\n  * remodeled-distro-detection.diff  \n\n- Adds imporoved distribution detection. Since now all base products\n  get detected correctly, we no longer need the SUSE Manager patch.\n- Added:\n  * remodeled-distro-detection.diff  \n\n- fix grub directory layout\n- Added:\n  * create-system-directory-at-the-correct-place.patch\n\n- fix HTTP status code of XMLRPC service\n- Added:\n  * fix-http-status-code.patch\n\n- touch /etc/genders when it not exists (boo#1128926)\n- Add patches to fix logging\n- Added:\n  * return-the-name-of-the-unknown-method.patch\n  * call-with-logger-where-possible.patch\n\n- Switching version schema from 3.0 to 3.0.0\n\n- Fixes case where distribution detection returns None (boo#1130658)\n- Added:\n  * fixes-distro-none-case.diff\n\n- Removes newline from token, which caused authentication error (boo#1128754)\n- Added:\n  * remove-newline-from-token.diff\n\n- Added a patch which fixes an exception when login in with a non-root user.\n- Added:\n  * fix-login-error.patch\n\n- Added a patch which fixes an exception when login in with a non-root user.\n- Added:\n  * fix-login-error.patch\n  \n\n- Remove patch merged at upstream:\n  * 0001-return-token-as-string.patch\n\n- change grub2-x86_64-efi dependency to Recommends\n\n- grub2-i386pc is not really required. Changed to recommended\n  to allow building for architectures other than x86_64\n\n- Use cdrtools starting with SLE-15 and Leap-15 again. (boo#1081739)\n- Update cobbler loaders server hostname (boo#980577)\n- Update outdated apache config (boo#956264)\n- Replace builddate with changelog date to fix build-compare (boo#969538)\n- LOCKFILE usage removed on openSUSE (boo#714618)\n- Power management subsystem completely re-worked to prevent\n  command-injection (CVE-2012-2395)\n- Removed patch merged at upstream:\n  * cobblerd_needs_apache2_service_started.patch\n\n- Checking bug fixes of released products are in latest develop pkg:\n  - remove fix-nameserver-search.fix; bug is invalid (boo#1029276)\n    -\u003e not needed anymore\n  - fix cobbler yaboot handling (boo#968406, boo#966622)\n    -\u003e no yaboot support anymore\n  - support UEFI boot with cobbler generated tftp tree (boo#1020376)\n    -\u003e upstream\n  - Enabling PXE grub2 support for PowerPC (boo#986978)\n    -\u003e We have grub2 support for ppc64le\n  - (boo#1048183) fix missing args and location for xen\n    -\u003e is in\n  - no koan support anymore:\n    boo#969541, boo#924118, boo#967523\n  - not installed (boo#966841)\n    works.\n- These still have to be looked at:\n  SUSE system as systemd only (boo#952844)\n  handle list value for kernel options \n  correctly (boo#973413) \n  entry in pxe menu (boo#988889)\n- This still has to be switched off (at least in internal cobbler versions):\n  Disabling 'get-loaders' command and 'check' fixed. boo#973418\n\n- Add explicity require to tftp, so it is used for both SLE\n  and openSUSE (originally from jgonzalez@suse.com)\n- Moved Recommends according to spec_cleaner\n\n- Require latest apache2-mod_wsgi-python3 package\n  This fixes interface to http://localhost/cblr/svc/...\n- Use latest github cobbler/cobbler master branch in _service file\n- cobblerd_needs_apache2_service_started.patch reverted, that is mainline\n  now:\n- Only recommend grub2-arm and grub2-ppc packages or we might not be\n  able to build on factory where arm/ppc might not be built\n- Remove genders package requires. A genders file is generated, but\n  we do not need/use the genders package.\n\n- Update to latest cobbler version 3.0 mainline git HEAD version\n  and remove already integrated or not needed anymore patches.\n- Serial console support added, did some testing already\n  Things should start to work as expected\n\n- Add general grub2 support\n\n- Put mkgrub.* into mkgrub.sh\n\n- Add git date and commit to version string for now\n\n- Add grub2 mkimage scripts:\nmkgrub.i386-pc\nmkgrub.powerpc-ieee1275\nmkgrub.x86_64-efi\nmkgrub.arm64-efi\n  and generate grub executables with them in the %post section\n  \n\n- build server wants explicite package in BuildRequires; use tftp\n- require tftp(server) instead of atftp\n- cleanup: cobbler is noarch, so arch specific requires do not make\n  sense\n- SLES15 is using /etc/os-release instead of /etc/SuSE-release, use\n  this one for checking also\n- add sles15 distro profile (boo#1090205)\n- fix signature for SLES15 (boo#1075014)\n- fix signature for SLES15 (boo#1075014)\n- fix koan wait parameter initialization\n- Fix koan shebang\n- Escape shell parameters provided by the user for the\n  reposync action (CVE-2017-1000469) (boo#1074594)\n- detect if there is already another instance of 'cobbler sync'\n  running and exit with failure if so (boo#1081714)\n- do not try to hardlink to a symlink. The result will be a\n  dangling symlink in the general case (boo#1097733)\n- fix service restart after logrotate for cobblerd (boo#1113747)\n- rotate cobbler logs at higher frequency to prevent disk fillup\n  (boo#1113747)\n- Forbid exposure of private methods in the API (CVE-2018-10931)\n  (CVE-2018-1000225) (boo#1104287) (boo#1104189) (boo#1105442)\n- Check access token when calling 'modify_setting' API endpoint\n  (boo#1104190) (boo#1105440) (CVE-2018-1000226)\n","status":"published","published":"2021-01-11T09:25:38Z","modified":"2026-02-04T03:02:10.540001Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0058-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- Add cobbler-tests subpackage for unit testing for openSUSE/SLE \n- Adds LoadModule definitions for openSUSE/SLE\n- Switch to new refactored auth module.\n\n- use systemctl to restart cobblerd on logfile rotation (boo#1169207)\n  Mainline logrotate conf file uses already /sbin/service instead of\n  outdated: /etc/init.d/cobblerd\n- Fix cobbler sync for DHCP or DNS (boo#1169553)\n  Fixed mainline by commit 2d6cfe42da\n- Signatures file now uses 'default_autoinstall' which fixes import\n  problem happening with some distributions (boo#1159010)\n  \n- Fix for kernel and initrd detection (boo#1159010)\n\n- New:\n  * For the distro there is now a parameter remote_boot_initrd and remote_boot_kernel ()\n  * For the profile there is now a parameter filename for DHCP. (#2280)\n  * Signatures for ESXi 6 and 7 (#2308)\n  * The hardlink command is now detected more dynamically and thus more error resistant (#2297)\n  * HTTPBoot will now work in some cases out of the bug. (#2295)\n  * Additional DNS query for a case where the wrong record was queried in the nsupdate system case (#2285)\n- Changes:\n  * Enabled a lot of tests, removed some and implemented new. (#2202)\n  * Removed not used files from the codebase. (#2302)\n  * Exchanged mkisofs to xorrisofs. (#2296)\n  * Removed duplicate code. (#2224)\n  * Removed unreachable code. (#2223)\n  * Snippet creation and deletion now works again via xmlrpc. (#2244)\n  * Replace createrepo with createrepo_c. (#2266)\n  * Enable Kerberos through having a case sensitive users.conf. (#2272)\n- Bugfixes:\n  * General various Bugfixes (#2331, )\n  * Makefile usage and commands. (#2344, #2304)\n  * Fix the dhcp template. (#2314)\n  * Creation of the management classes and gPXE. (#2310)\n  * Fix the scm_track module. (#2275, #2279)\n  * Fix passing the netdevice parameter correctly to the linuxrc. (#2263)\n  * powerstatus from cobbler now works thanks to a wrapper for ipmitool. (#2267)\n  * In case the LDAP is used for auth, it now works with ADs. (#2274)\n  * Fix passthru authentication. (#2271)\n- Other:\n  * Add Codecov. (#2229)\n  * Documentation updates. (#2333, #2326, #2305, #2249, #2268)\n  * Buildprocess:\n    *  Recreation and cleanup of Grub2. (#2278)\n    *  Fix small errors for openSUSE Leap. (#2233)\n    *  Fix rpmlint errors. (#2237)\n    *  Maximum compatibility for debbuild package creation. (#2255, #2292, #2242, #2300)\n  * Fixes related to our CI Pipeline (#2254, #2269)\n  * Internal Code cleanup (#2273, #2270)\n- Breaking Changes:\n  * Hash handling in users.digest file. (#2299) \n\n- Updated to version 3.1.1.\n  * Introduce new packaging from upstream\n  * Changelog see below\n- New:\n  * We are now having a cross-distro specfile which can be build in the OBS\n    (#2220) - before rewritten it was improved by #2144 \u0026 #2174\n  * Grub Submenu for net-booting machines (#2217)\n  * Building the Cent-OS RPMs in Docker (#2190 #2189)\n  * Reintroduced manpage build in setup.py (#2185)\n  * mgmt_parameters are now passed to the dhcp template (#2182)\n  * Using the standard Pyhton3 logger instead of a custom one (#2160 #2139 #2151)\n  * Script for converting the settings file from 3.0.0 to 3.0.1 (#2154)\n  * Docs now inside the repo instead of cobbler.github.io and improved with sphinx (#2117)\n- Changes:\n  * The default tftpboot directory is now /var/lib/tftpboot instead of previously /srv/tftpboot (#2220)\n  * Distro signatures were adjusted where necessary (#2219 #2134)\n  * Removed requirements.txt and placed the requirements in setup.py (#2204)\n  * Display only entries in grub which are from the same arch (#2191 #2216)\n  * Change the name of the cobbler manpage form cobbler-cli to cobbler back and move it to section 8 (#2188 #2186)\n- Bugfixes:\n  * Incremented Version to 3.1.1 from 3.0.1\n  * S390 Support was cleaned up (#2207 #2178)\n  * PowerPC Support was cleaned up (#2178)\n  * Added a missing import while importing a distro with cobbler import (#2201)\n  * Fixed a case where a stacktrace would be produced so pass none instead (#2203)\n  * Rename of suse_kopts_textmode_overwrite to kops_overwrite to utils (#2143 #2200)\n  * Fix rsync subprocess call (#2199 #2179)\n  * Fixed an error where the template rendering did not work (#2176)\n  * Fixed some cobbler import errors (#2172)\n  * Wrong shebang in various scripts (#2148)\n  * Fix some imports which fixes errors introduced by the remodularization (#2150 #2153)\n- Other:\n  * Issue Templates for Github (#2187)\n\n- Update to latest git HEAD code base\n  This version (from mainline so for quite a while already)\n  also includes fixes for 'boo#1149075' and boo#1151875\n\n- Fix for cobbler import and buildiso (boo#1156574)\n- Adjusted manpage creation (needs sphinx as BuildRequires)\n- Fix cobbler sync for dhcp and dns enabled due to latest module\n  renaming patches\n\n- Update to latest git HEAD\n   - Fixes permission denied in apache2 context when trying to write\n     cobbler log\n   - Fixes a bad import in import_signature (item)\n   - Fixes bad shebang bash path in mkgrub.sh (used in post section)\n\n- Now track Github master branch\n  WARNING: This release contains breaking changes for your settings file! \n  * Notable changes:\n    - Now using standard python logger\n    - Updated dhcpd.template \n- Removed fix_shebang.patch: now in upstream. \n- added -s parameter to fdupes call to prevent hardlink across \n  partititons\n\n- Update to latest v3.0.0 cobbler release\n- Add previouly added patch: exclude_get-loaders_command.patch to\n  the list of patches to apply.\n\n- Fix log file world readable (as suggested by Matthias Gerstner)\n  and change file attributes via attr in spec file\n- Do not allow get-loaders command (download of third party\n  provided network boot loaders we do not trust)\n- Mainline fixes:\n  3172d1df9b9cc8 Add missing help text in redhat_management_key field\n  c8f5490e507a72 Set default interface if cobbler system add has no\n                 --interface= param\n  31a1aa31d26c4a Remove apache IfVersion tags from apache configs\n\n- Integrated fixes that came in from mainline from other products\n  (to calm down obs regression checker):\n  CVE-2011-4953, fate#312397, boo#660126, boo#671212, boo#672471, boo#682665\n  boo#687891, boo#695955, boo#722443, boo#722445, boo#757062, boo#763610\n  boo#783671, boo#790545, boo#796773, boo#811025, boo#812948, boo#842699\n  boo#846580, boo#869371, boo#884051, boo#976826, boo#984998\n  Some older bugs need boo# references as well:\n  boo#660126, boo#671212, boo#672471, boo#682665\n  boo#687891, boo#695955, boo#722443, boo#722445, boo#757062, boo#763610\n  boo#783671, boo#790545, boo#796773, boo#811025, boo#812948, boo#842699\n  boo#846580, boo#869371, boo#884051\n\n- Fix for redhat_management_key not being listed as a choice\n  during profile rename (boo#1134588)\n- Added:\n  * rhn-mngmnt-key-field-fix.diff\n\n- Fixes distribution detection in setup.py for SLESo\n- Added:\n  * changes-detection-to-distro-like-for-suse-distributions.diff\n\n- Moving to pytest and adding Docker test integration\n- Added:\n  * add-docker-integration-testing.diff\n  * refactor-unittest-to-pytest.diff\n\n- Additional compatability changes for old Koan versions.\n- Modified:\n  * renamed-methods-alias-part2.patch\n\n- Old Koan versions not only need method aliases, but also need\n  compatible responses\n- Added:\n  * renamed-methods-alias-part2.patch\n\n- Add the redhat_managment_* fields again to enable templating in SUMA.\n- Added:\n  * revert-redhat-management-removal.patch  \n\n- Changes return of last_modified_time RPC to float\n- Added:\n  * changes-return-to-float.diff\n\n- provide old name aliases for all renamed methods:\n  - get_distro_for_koan     =\u003e  get_distro_as_rendered\n  - get_profile_for_koan    =\u003e  get_profile_as_rendered\n  - get_system_for_koan     =\u003e  get_system_as_rendered\n  - get_repo_for_koan       =\u003e  get_repo_as_rendered\n  - get_image_for_koan      =\u003e  get_image_as_rendered\n  - get_mgmtclass_for_koan  =\u003e  get_mgmtclass_as_rendered\n  - get_package_for_koan    =\u003e  get_package_as_rendered\n  - get_file_for_koan       =\u003e  get_file_as_rendered\n- Renamed:\n  get_system_for_koan.patch =\u003e renamed-methods-alias.patch\n\n- provide renamed method 'get_system_for_koan' under old name\n  for old clients.\n- Added:\n  * get_system_for_koan.patch\n\n- Bring back power_system method in the XML-RPC API\n- Changed lanplus option to lanplus=true in fence_ipmitool.template\n- Added:\n  * power_system_xmlrpc_api.patch\n- Changed:\n  * fence_ipmitool.template\n\n- Disables nsupdate_enabled by default\n- Added:\n  * disable_nsupdate_enabled_by_default.diff\n\n- Fixes issue in distribution detection with 'lower' function call.\n- Modified:\n  * remodeled-distro-detection.diff  \n\n- Adds imporoved distribution detection. Since now all base products\n  get detected correctly, we no longer need the SUSE Manager patch.\n- Added:\n  * remodeled-distro-detection.diff  \n\n- fix grub directory layout\n- Added:\n  * create-system-directory-at-the-correct-place.patch\n\n- fix HTTP status code of XMLRPC service\n- Added:\n  * fix-http-status-code.patch\n\n- touch /etc/genders when it not exists (boo#1128926)\n- Add patches to fix logging\n- Added:\n  * return-the-name-of-the-unknown-method.patch\n  * call-with-logger-where-possible.patch\n\n- Switching version schema from 3.0 to 3.0.0\n\n- Fixes case where distribution detection returns None (boo#1130658)\n- Added:\n  * fixes-distro-none-case.diff\n\n- Removes newline from token, which caused authentication error (boo#1128754)\n- Added:\n  * remove-newline-from-token.diff\n\n- Added a patch which fixes an exception when login in with a non-root user.\n- Added:\n  * fix-login-error.patch\n\n- Added a patch which fixes an exception when login in with a non-root user.\n- Added:\n  * fix-login-error.patch\n  \n\n- Remove patch merged at upstream:\n  * 0001-return-token-as-string.patch\n\n- change grub2-x86_64-efi dependency to Recommends\n\n- grub2-i386pc is not really required. Changed to recommended\n  to allow building for architectures other than x86_64\n\n- Use cdrtools starting with SLE-15 and Leap-15 again. (boo#1081739)\n- Update cobbler loaders server hostname (boo#980577)\n- Update outdated apache config (boo#956264)\n- Replace builddate with changelog date to fix build-compare (boo#969538)\n- LOCKFILE usage removed on openSUSE (boo#714618)\n- Power management subsystem completely re-worked to prevent\n  command-injection (CVE-2012-2395)\n- Removed patch merged at upstream:\n  * cobblerd_needs_apache2_service_started.patch\n\n- Checking bug fixes of released products are in latest develop pkg:\n  - remove fix-nameserver-search.fix; bug is invalid (boo#1029276)\n    -\u003e not needed anymore\n  - fix cobbler yaboot handling (boo#968406, boo#966622)\n    -\u003e no yaboot support anymore\n  - support UEFI boot with cobbler generated tftp tree (boo#1020376)\n    -\u003e upstream\n  - Enabling PXE grub2 support for PowerPC (boo#986978)\n    -\u003e We have grub2 support for ppc64le\n  - (boo#1048183) fix missing args and location for xen\n    -\u003e is in\n  - no koan support anymore:\n    boo#969541, boo#924118, boo#967523\n  - not installed (boo#966841)\n    works.\n- These still have to be looked at:\n  SUSE system as systemd only (boo#952844)\n  handle list value for kernel options \n  correctly (boo#973413) \n  entry in pxe menu (boo#988889)\n- This still has to be switched off (at least in internal cobbler versions):\n  Disabling 'get-loaders' command and 'check' fixed. boo#973418\n\n- Add explicity require to tftp, so it is used for both SLE\n  and openSUSE (originally from jgonzalez@suse.com)\n- Moved Recommends according to spec_cleaner\n\n- Require latest apache2-mod_wsgi-python3 package\n  This fixes interface to http://localhost/cblr/svc/...\n- Use latest github cobbler/cobbler master branch in _service file\n- cobblerd_needs_apache2_service_started.patch reverted, that is mainline\n  now:\n- Only recommend grub2-arm and grub2-ppc packages or we might not be\n  able to build on factory where arm/ppc might not be built\n- Remove genders package requires. A genders file is generated, but\n  we do not need/use the genders package.\n\n- Update to latest cobbler version 3.0 mainline git HEAD version\n  and remove already integrated or not needed anymore patches.\n- Serial console support added, did some testing already\n  Things should start to work as expected\n\n- Add general grub2 support\n\n- Put mkgrub.* into mkgrub.sh\n\n- Add git date and commit to version string for now\n\n- Add grub2 mkimage scripts:\nmkgrub.i386-pc\nmkgrub.powerpc-ieee1275\nmkgrub.x86_64-efi\nmkgrub.arm64-efi\n  and generate grub executables with them in the %post section\n  \n\n- build server wants explicite package in BuildRequires; use tftp\n- require tftp(server) instead of atftp\n- cleanup: cobbler is noarch, so arch specific requires do not make\n  sense\n- SLES15 is using /etc/os-release instead of /etc/SuSE-release, use\n  this one for checking also\n- add sles15 distro profile (boo#1090205)\n- fix signature for SLES15 (boo#1075014)\n- fix signature for SLES15 (boo#1075014)\n- fix koan wait parameter initialization\n- Fix koan shebang\n- Escape shell parameters provided by the user for the\n  reposync action (CVE-2017-1000469) (boo#1074594)\n- detect if there is already another instance of 'cobbler sync'\n  running and exit with failure if so (boo#1081714)\n- do not try to hardlink to a symlink. The result will be a\n  dangling symlink in the general case (boo#1097733)\n- fix service restart after logrotate for cobblerd (boo#1113747)\n- rotate cobbler logs at higher frequency to prevent disk fillup\n  (boo#1113747)\n- Forbid exposure of private methods in the API (CVE-2018-10931)\n  (CVE-2018-1000225) (boo#1104287) (boo#1104189) (boo#1105442)\n- Check access token when calling 'modify_setting' API endpoint\n  (boo#1104190) (boo#1105440) (CVE-2018-1000226)\n\nThis update was imported from the openSUSE:Leap:15.2:Update update project.","status":"published","published":"2021-01-14T15:26:47Z","modified":"2026-02-04T03:54:24.421448Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10282-1","title":"cobbler-2.6.6-4.2 on GA media","description":"These are all security issues fixed in the cobbler-2.6.6-4.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:19.202261Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"PYSEC-2026-792","title":"Cobbler subject to Command Injection","description":"A Command Injection in action_power.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","status":"published","published":"2026-07-06T08:03:27.199888Z","modified":"2026-07-07T11:45:43.803835389Z","updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2012:1060","title":"Red Hat Security Advisory: cobbler security update","status":"published","published":"2024-09-15T20:01:17Z","modified":"2026-01-29T10:55:40.239849Z","updated_at":"2026-11-02T15:53:01.495018Z"},{"id":"UBUNTU-CVE-2012-2395","description":"Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.","status":"withdrawn","published":"2012-06-16T00:55:00Z","modified":"2025-07-16T07:30:55.518058Z","updated_at":"2026-11-02T15:54:06.395274Z"}]}}