{"id":"CVE-2021-40323","aliases":["EUVD-2021-0044","GHSA-cpqf-3c3r-c9g2","OESA-2025-1467","OESA-2025-1468","OESA-2025-1469","OESA-2025-1527","PYSEC-2021-373","SUSE-RU-2021:3162-1","SUSE-SU-2021:3151-1","SUSE-SU-2021:3170-1","UBUNTU-CVE-2021-40323","USN-6475-1"],"status":"published","title":"Cobbler before 3.3.0 allows log poisoning","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.86829,"percentile":0.99746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2021-09-20T15:21:44Z","modified":"2026-10-20T10:53:54Z","exploits":[{"source":"nuclei","id":"CVE-2021-40323","title":"Cobbler \u003c3.3.0 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40323.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"cobbler","fixed_in":["3.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","fixed_in":["2.4.1-0ubuntu2+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}],"versions":["0.6.3-2","3.1.2","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2403"}]}],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"d8f60bbf14a838c8c8a1dba98086b223e35fe70a"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0"}]}],"versions":["0.6.3-2","3.1.2","3.2.1","3.2.2","3.2.3"]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.2","package":"release-notes-susemanager-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"release-notes-susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-3.12.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-8.22.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"branch-network-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1628156312.dbd0dec-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-5.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"cpu-mitigations-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"inter-server-sync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.5-8.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"openvpn-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"prometheus-exporters-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py26-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2016.11.10-11.28.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"py27-compat-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3000.3-7.7.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"saltboot-formula","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1628156312.dbd0dec-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.12-4.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-4.6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-certs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.12-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-4.6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.28-3.11.5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.13-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"spacewalk-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.21-3.6.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.22-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-build-keys","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.3.5-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-doc-indexes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-12.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-docs_en","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-12.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.17-3.6.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"susemanager-sync-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8-3.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-0ubuntu2+esm1"}]}],"versions":["2.4.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-0ubuntu2+esm1"}]}],"versions":["2.4.1-0ubuntu2"],"bundled":11}],"products":[{"vendor":"cobbler_project","product":"cobbler"}],"references":[{"url":"https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/cobbler/cobbler/releases/tag/v3.3.0","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40323","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cpqf-3c3r-c9g2","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2021-373.yaml","tags":["web"]},{"url":"https://github.com/cobbler/cobbler","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45083","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1468","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1469","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1527","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2021-3162/suse-ru-20213162-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171483","tags":["report"]},{"url":"https://bugzilla.suse.com/1173143","tags":["report"]},{"url":"https://bugzilla.suse.com/1181223","tags":["report"]},{"url":"https://bugzilla.suse.com/1186026","tags":["report"]},{"url":"https://bugzilla.suse.com/1186281","tags":["report"]},{"url":"https://bugzilla.suse.com/1186339","tags":["report"]},{"url":"https://bugzilla.suse.com/1187335","tags":["report"]},{"url":"https://bugzilla.suse.com/1187549","tags":["report"]},{"url":"https://bugzilla.suse.com/1188032","tags":["report"]},{"url":"https://bugzilla.suse.com/1188042","tags":["report"]},{"url":"https://bugzilla.suse.com/1188136","tags":["report"]},{"url":"https://bugzilla.suse.com/1188163","tags":["report"]},{"url":"https://bugzilla.suse.com/1188193","tags":["report"]},{"url":"https://bugzilla.suse.com/1188260","tags":["report"]},{"url":"https://bugzilla.suse.com/1188393","tags":["report"]},{"url":"https://bugzilla.suse.com/1188400","tags":["report"]},{"url":"https://bugzilla.suse.com/1188503","tags":["report"]},{"url":"https://bugzilla.suse.com/1188505","tags":["report"]},{"url":"https://bugzilla.suse.com/1188551","tags":["report"]},{"url":"https://bugzilla.suse.com/1188641","tags":["report"]},{"url":"https://bugzilla.suse.com/1188647","tags":["report"]},{"url":"https://bugzilla.suse.com/1188656","tags":["report"]},{"url":"https://bugzilla.suse.com/1188853","tags":["report"]},{"url":"https://bugzilla.suse.com/1188855","tags":["report"]},{"url":"https://bugzilla.suse.com/1189011","tags":["report"]},{"url":"https://bugzilla.suse.com/1189040","tags":["report"]},{"url":"https://bugzilla.suse.com/1189167","tags":["report"]},{"url":"https://bugzilla.suse.com/1189263","tags":["report"]},{"url":"https://bugzilla.suse.com/1189419","tags":["report"]},{"url":"https://bugzilla.suse.com/1189458","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-40325","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213151-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213170-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-40323","tags":["report"]},{"url":"https://github.com/cobbler/cobbler/pull/2794","tags":["report"]},{"url":"https://tnpitsecurity.com/blog/cobbler-multiple-vulnerabilities/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6475-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0860","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-40323","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-04T05:37:50Z","modified":"2024-08-04T02:27:31.884Z","updated_at":"2026-11-02T14:33:01.852999Z"}],"euvd":[{"id":"EUVD-2021-0044","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-04T05:37:50Z","modified":"2024-08-04T02:27:31Z","updated_at":"2026-11-03T03:24:21.368958Z"}],"ghsa":[{"id":"GHSA-cpqf-3c3r-c9g2","title":"Cobbler before 3.3.0 allows log poisoning","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-05T17:53:20Z","modified":"2024-09-13T15:11:52Z","cvss":[{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2021-40323","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-04T06:15:07.187Z","modified":"2026-06-17T04:06:43.587Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"CVE-2021-40323","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-04T06:15:07.187Z","modified":"2026-10-20T10:53:54.624184352Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"GHSA-cpqf-3c3r-c9g2","title":"Cobbler before 3.3.0 allows log poisoning","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-05T17:53:20Z","modified":"2026-09-10T03:49:09.10565773Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"OESA-2025-1467","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:33Z","modified":"2026-08-18T01:18:50.235139876Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1468","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:50.29775514Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1469","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:23.263292787Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1527","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-16T11:08:37Z","modified":"2026-08-18T01:17:57.846852131Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2021-40323","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-04T06:15:00Z","modified":"2026-02-04T04:32:00.208729Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:28.526929Z"},{"id":"PYSEC-2021-373","description":"Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.","status":"published","published":"2021-10-04T06:15:00Z","modified":"2025-10-09T07:55:27.769254Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"SUSE-RU-2021:3162-1","title":"Recommended update for SUSE Manager 4.2.2 Release Notes","description":"This update for SUSE Manager 4.2.2 Release Notes provides the following additions:\n\nRelease notes for SUSE Manager:\n\n- Update to 4.2.2\n  * SUSE Manager is now able to manage Rocky Linux 8 clients\n  * Tech Preview: Inter-Server Sync V2\n  * Bugs mentioned\n    bsc#1171483, bsc#1173143, bsc#1181223, bsc#1186281,\n    bsc#1186339, bsc#1187335, bsc#1187549, bsc#1188032,\n    bsc#1188042, bsc#1188136, bsc#1188163, bsc#1188193,\n    bsc#1188260, bsc#1188393, bsc#1188400, bsc#1188503,\n    bsc#1188505, bsc#1188551, bsc#1188641, bsc#1188647,\n    bsc#1188656, bsc#1188853, bsc#1188855, bsc#1189011,\n    bsc#1189040, bsc#1189167, bsc#1189419, bsc#1189458,\n    - CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458)\n    - CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)\n    - CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)\n      - Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded \n        to cobbler may be rejected.\n\nRelease notes for SUSE Manager proxy:\n\n- Update to 4.2.2\n  * Bugs mentioned\n    bsc#1181223, bsc#1186026, bsc#1188042, bsc#1189011, bsc#1189263\n","status":"published","published":"2021-09-20T15:24:13Z","modified":"2026-02-04T04:18:44.589328Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2021:3151-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458)\n- CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)\n- CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)\n\n- Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded to \n  cobbler may be rejected\n","status":"published","published":"2021-09-20T15:21:44Z","modified":"2025-05-02T04:31:48.810923Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3170-1","title":"Security update for SUSE Manager Server 4.2","description":"This update fixes the following issues:\n\nbranch-network-formula:\n\n- Use kernel parameters from PXE formula also for local boot\n\ncobbler - security issues fixed:\n\n- CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458)\n- CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)\n- CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)\n- Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded to \n  cobbler may be rejected:\n\ncpu-mitigations-formula:\n\n- Add SLES 15 SP3 and openSUSE Leap 15.3 to supported versions\n\nopenvpn-formula:\n\n- Changed package to noarch.\n\nprometheus-exporters-formula:\n\n- Fix formula data migration with missing exporter configuration (bsc#1188136)\n\npy26-compat-salt:\n\n- Fix error handling in openscap module (bsc#1188647)\n- Define license macro as doc in spec file if not existing \n\npy27-compat-salt:\n\n- Add missing aarch64 to rpm package architectures\n- Consolidate some state requisites (bsc#1188641)\n- Fix failing unit test for systemd\n- Fix error handling in openscap module (bsc#1188647)\n- Better handling of bad public keys from minions (bsc#1189040)\n- Define license macro as doc in spec file if not existing\n\nsaltboot-formula:\n\n- Use kernel parameters from PXE formula also for local boot\n\nspacecmd:\n\n- Update translation strings\n- Make schedule_deletearchived to get all actions without display limit\n- Allow passing a date limit for schedule_deletearchived on spacecmd (bsc#1181223)\n- Use correct API endpoint in list_proxies (bsc#1188042)\n- Add schedule_deletearchived to bulk delete archived actions (bsc#1181223)\n\nspacewalk-backend:\n\n- Update translation strings\n- Fix typo 'verfication' instead of 'verification'\n\nspacewalk-certs-tools:\n\n- Prepare the bootstrap script generator for Rocky Linux 8\n\nspacewalk-client-tools:\n\n- Update translation strings\n\nspacewalk-java:\n\n- Show AppStreams tab just for modular channels\n- Fix Json null comparison in virtual network info parsing (bsc#1189167)\n- Update translation strings\n- 'AppStreams with defaults' filter template in CLM\n- Add a link to OS image store dir in image list page\n- Do not log XMLRPC fault exceptions as errors (bsc#1188853)\n- XMLRPC: Add call for listing application monitoring endpoints\n- AppStreams tab for modular channels\n- Link to CLM filter creation from system details page\n- Allow getting all archived actions via XMLRPC without display limit (bsc#1181223)\n- Fix NPE when no redhat info could be fetched\n- Java enablement for Rocky Linux 8\n- Delete ActionChains when the last action is a Reboot and it completes (bsc#1188163)\n- Properly handle virtual networks without defined bridge (bsc#1189167)\n- Mark SSH minion actions when they're picked up (bsc#1188505)\n- Add UEFI support for VM creation / editing\n- Add virt-tuner templates to VM creation\n- Fix cleanup always being executed on delete system (bsc#1189011)\n- Warning in Overview page for SLE Micro system (bsc#1188551)\n- Add support for Kiwi options\n- Ensure XMLRPC returns 'issue_date' in ISO format when listing erratas (bsc#1188260)\n- Fix NullPointerException in HardwareMapper.getUpdatedGuestMemory\n- Fix entitlements not being updated during system transfer (bsc#1188032)\n- Simplify the VM creation action in DB\n- Get CPU data for AArch64\n- Handle virtual machines running on pacemaker cluster\n- Refresh virtual host pillar to clear the virtpoller beacon (bsc#1188393)\n- Add Beijing timezone to selectable timezones (bsc#1188193)\n- Fix updating primary net interface on hardware refresh (bsc#1188400)\n- Fix issues when removing archived actions using XMLRPC api (bsc#1181223)\n- Readable error when 'mgr-sync add channel' is called with a no-existing label (bsc#1173143)\n\nspacewalk-setup:\n\n- Enable logging for salt SSH\n- Increase max size for uploaded files to Salt master\n\nspacewalk-utils:\n\n- Add Rocky Linux 8 repositories\n\nspacewalk-web:\n\n- Don't capitalize acronyms\n- Update translation strings\n- 'AppStreams with defaults' filter template in CLM\n- Add a link to OS image store dir in image list page\n- Link to CLM filter creation from system details page\n- Expose UEFI parameters in the VM creation/editing pages\n- Add virt-tuner templates to VM creation\n- Fix cleanup always being executed on delete system (bsc#1189011)\n- Add support for Kiwi options\n- Fix virtualization guests to handle null HostInfo\n- Compare lowercase CPU arch with libvirt domain capabilities\n- Refresh JWT virtual console token before it expires\n- Handle virtual machines running on pacemaker cluster\n\nsusemanager:\n\n- Abort migration if data_directory is defined at the PostgreSQL\n  configuration file\n- Update translation strings\n- Add bootstrap repository definitions for Rocky Linux 8\n\nsusemanager-build-keys:\n\n- Add Debian 11\n- Add Rocky Linux 8\n\nsusemanager-doc-indexes:\n\n- Added SUSE Linux Enterprise 15 Service Pack 3 to clients list\n- Add information about pam service name limitations\n- Add SUSE Linux Enterprise Micro to supported features table\n- Add SUSE Linux Enterprise Micro client to support matrix page\n- Replaced remaining occurrences of 'Service Pack Migration' to 'Product Migration'\n- Reworded the Advanced virtual guest management description for clarity in Client Configuration Guide\n- Added missing Rocky instructions to the Client Configuration Guide\n- Updated setup section in the Installation Guide about troubleshooting freely available products\n- Added channel synchronization warning in the product migration chapter of the Client Configuration Guide\n- Removed Red Hat Enterprise Linux 6, SUSE Linux Enterprise Server Expanded Support 6, Oracle Linux 6, CentOS 6, and \n  Ubuntu 16.04 LTS as supported client systems in the Client Configuration Guide (bsc#1188656)\n- In the Prometheus chapter of the Administration Guide advise to store data locally (bsc#1188855)\n- Additional information added for Inter Server Sync v2 on limitations and configuration\n- Documented required SUSE Linux Enterprise Server version for the Ansible control node in the Ansible Integration \n  chapter of the Administration Guide (bsc#1189419)\n- Added information about installing Python 3.6 on CentOS, Oracle Linux, Almalinux, SUSE Linux Enterprise Server with \n  Expanded Support, and Red Hat in the Client Configuration Guide (bsc#1187335)\n- Corrected the package name for PAM authentication (bsc#1171483)\n- Client Configuration Guide: reorganized navigation bar to list SUSE Linux Enterprise Server, openSUSE and other \n  clients in alphabetical order for better user experience\n- In the Ansible chapter of the Administration Guide mention that Ansible is available on Proxy and Retail Branch \n  Server\n- Added a warning on Ansible hardware requirements to the Retail Guide\n- Improved warning on over-writing images in public cloud in the Client Configuration Guide\n- Reference Guide: removed underscores in page titles and nav bar links.\n- Provide more information about Salt SSH user configuration in the Salt Guide (bsc#1187549)\n- Documented KIWI options and profile selection in Administration Guide\n- Added note about autoinstallation kernel options and Azure clients\n- Added general information about SUSE Manager registration code that you can obtain from a 'SUSE Manager Lifecycle \n  Management+' subscription\n- Document new Salt SSH logs at the Client Configuration Guide, Troubleshooting section\n- In the monitoring chapter of the Administration Guide mention that Prometheus is available on Proxy and Retail \n  Branch Server\n- Added warning on Prometheus hardware requirements in the Retail Guide (bsc#1186339)\n- Documented spacecmd installation on Ubuntu 18.04 and 20.04 in Client Configuration Guide\n- Amended Client Configuration Guide to exclude paragraphs that are Uyuni specific for CentOS, AlmaLinux and Oracle \n  clients\n\nsusemanager-docs_en:\n\n- Added SUSE Linux Enterprise 15 Service Pack 3 to clients list\n- Add information about pam service name limitations\n- Add SUSE Linux Enterprise Micro to supported features table\n- Add SUSE Linux Enterprise Micro client to support matrix page\n- Replaced remaining occurrences of 'Service Pack Migration' to 'Product Migration'\n- Reworded the Advanced virtual guest management description for clarity in Client Configuration Guide\n- Added missing Rocky instructions to the Client Configuration Guide\n- Updated setup section in the Installation Guide about troubleshooting freely available products\n- Added channel synchronization warning in the product migration chapter of the Client Configuration Guide\n- Removed Red Hat Enterprise Linux 6, SUSE Linux Enterprise Server Expanded Support 6, Oracle Linux 6, CentOS 6, and \n  Ubuntu 16.04 LTS as supported client systems in the Client Configuration Guide (bsc#1188656)\n- In the Prometheus chapter of the Administration Guide advise to store data locally (bsc#1188855)\n- Additional information added for Inter Server Sync v2 on limitations and configuration\n- Documented required SUSE Linux Enterprise Server version for the Ansible control node in the Ansible Integration \n  chapter of the Administration Guide (bsc#1189419)\n- Added information about installing Python 3.6 on CentOS, Oracle Linux, Almalinux, SUSE Linux Enterprise Server with \n  Expanded Support, and Red Hat in the Client Configuration Guide (bsc#1187335)\n- Corrected the package name for PAM authentication (bsc#1171483)\n- Client Configuration Guide: reorganized navigation bar to list SUSE Linux Enterprise Server, openSUSE and other \n  clients in alphabetical order for better user experience\n- In the Ansible chapter of the Administration Guide mention that Ansible is available on Proxy and Retail Branch \n  Server\n- Added a warning on Ansible hardware requirements to the Retail Guide\n- Improved warning on over-writing images in public cloud in the Client Configuration Guide\n- Reference Guide: removed underscores in page titles and nav bar links.\n- Provide more information about Salt SSH user configuration in the Salt Guide (bsc#1187549)\n- Documented KIWI options and profile selection in Administration Guide\n- Added note about autoinstallation kernel options and Azure clients\n- Added general information about SUSE Manager registration code that you can obtain from a 'SUSE Manager Lifecycle \n  Management+' subscription\n- Document new Salt SSH logs at the Client Configuration Guide, Troubleshooting section\n- In the monitoring chapter of the Administration Guide mention that Prometheus is available on Proxy and Retail Branch\n  Server\n- Added warning on Prometheus hardware requirements in the Retail Guide (bsc#1186339)\n- Documented spacecmd installation on Ubuntu 18.04 and 20.04 in Client Configuration Guide\n- Amended Client Configuration Guide to exclude paragraphs that are Uyuni specific for CentOS, AlmaLinux and Oracle \n  clients\n\nsusemanager-schema:\n\n- Add Rocky Linux 8 key and vendor\n- Fix wrongly assigned entitlements due to system transfer (bsc#1188032)\n- Force a one-off VACUUM ANALYZE\n- Add Kiwi commandline options to Kiwi profile\n- Upgrade scripts idempotency fixes\n- Simplify the VM creation action in DB\n- Handle virtual machines running on pacemaker cluster\n- Refresh virtual host pillar to clear the virtpoller beacon (bsc#1188393)\n- Add Beijing timezone to selectable timezones (bsc#1188193)\n\nsusemanager-sls:\n\n- Add Rocky Linux 8 support\n- Enable logrotate configuration for Salt SSH minion logs\n- Add UEFI support for VM creation\n- Add virt-tuner templates to VM creation\n- Handle more ocsf2 setups in virt_utils module\n- Add missing symlinks to generate the 'certs' state for SLE Micro 5.0 and openSUSE MicroOS minions (bsc#1188503)\n- Add findutils to Kiwi bootstrap packages\n- Remove systemid file on salt client cleanup\n- Add support for Kiwi options\n- Skip 'update-ca-certificates' run if the certs are updated automatically\n- Use lscpu to provide more CPU grains for all architectures\n- Fix deleting stopped virtual network (bsc#1186281)\n- Handle virtual machines running on pacemaker cluster\n\nsusemanager-sync-data:\n\n- Support Rocky Linux 8 x86_64\n- Add channel family for MicroOS Z\n- Set OES 2018 SP3 to released\n\nHow to apply this update:\n1. Log in as root user to the SUSE Manager server.\n2. Stop the Spacewalk service:\n`spacewalk-service stop`\n3. Apply the patch using either zypper patch or YaST Online Update.\n4. Start the Spacewalk service:\n`spacewalk-service start`\n","status":"published","published":"2021-09-20T15:26:33Z","modified":"2026-02-04T04:19:38.074208Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-6475-1","title":"cobbler vulnerabilities","description":"It was discovered that Cobbler did not properly handle user input, which\ncould result in an absolute path traversal. An attacker could possibly \nuse this issue to read arbitrary files. (CVE-2014-3225)\n\nIt was discovered that Cobbler did not properly handle user input, which\ncould result in command injection. An attacker could possibly use this \nissue to execute arbitrary code with high privileges. \n(CVE-2017-1000469, CVE-2021-45082)\n\nIt was discovered that Cobbler did not properly hide private functions in\na class. A remote attacker could possibly use this issue to gain high \nprivileges and upload files to an arbitrary location. \n(CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)\n\nNicolas Chatelain discovered that Cobbler did not properly handle user \ninput, which could result in log poisoning. A remote attacker could \npossibly use this issue to bypass authorization, write in an arbitrary \nfile, or execute arbitrary code. \n(CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)\n\nIt was discovered that Cobbler did not properly handle file permissions \nduring package install or update operations. An attacker could possibly \nuse this issue to perform a privilege escalation attack. (CVE-2021-45083)\n\nIt was discovered that Cobbler did not properly process credentials for \nexpired accounts. An attacker could possibly use this issue to login to \nthe platform with an expired account or password. (CVE-2022-0860)\n","status":"published","published":"2023-11-13T15:04:17Z","modified":"2026-06-25T13:31:28.777084885Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}