{"id":"CVE-2021-45082","aliases":["EUVD-2022-0040","GHSA-6cm4-gm85-972c","OESA-2025-1467","OESA-2025-1468","OESA-2025-1469","OESA-2025-1527","PYSEC-2022-37","SUSE-SU-2022:0509-1","SUSE-SU-2022:0510-1","UBUNTU-CVE-2021-45082","USN-6475-1","openSUSE-SU-2024:11853-1"],"status":"published","title":"Command Injection in Cobbler","description":"An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00495,"percentile":0.43018,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2022-02-18T10:45:09Z","modified":"2026-10-20T10:54:11Z","fixes":[{"ecosystem":"PyPI","package":"cobbler","fixed_in":["3.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","fixed_in":["2.4.1-0ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cobbler","fixed_in":["3.3.1.0+git.f5b0599a-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}],"versions":["0.6.3-2","3.1.2","3.2.1","3.2.2","3.2.3","3.3.0"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2403"}]}],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}],"versions":["0.6.3-2","3.1.2","3.2.1","3.2.2","3.3.0","3.2.3"]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150300.5.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-8.22.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-0ubuntu2+esm1"}]}],"versions":["2.4.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-0ubuntu2+esm1"}]}],"versions":["2.4.1-0ubuntu2"],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1.0+git.f5b0599a-1.1"}]}]}],"products":[{"vendor":"cobbler_project","product":"cobbler"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports"},{"vendor":"opensuse","product":"factory"},{"vendor":"suse","product":"linux_enterprise_server"}],"references":[{"url":"https://github.com/cobbler/cobbler/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1193678","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45082","tags":["advisory"]},{"url":"https://github.com/cobbler/cobbler/pull/2945","tags":["web"]},{"url":"https://github.com/cobbler/cobbler/releases/tag/v3.3.1","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2022-37.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6cm4-gm85-972c","tags":["advisory"]},{"url":"https://github.com/cobbler/cobbler","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45083","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1468","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1469","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1527","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220509-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193671","tags":["report"]},{"url":"https://bugzilla.suse.com/1193673","tags":["report"]},{"url":"https://bugzilla.suse.com/1193675","tags":["report"]},{"url":"https://bugzilla.suse.com/1193676","tags":["report"]},{"url":"https://bugzilla.suse.com/1193678","tags":["report"]},{"url":"https://bugzilla.suse.com/1195906","tags":["report"]},{"url":"https://bugzilla.suse.com/1195918","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45083","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220510-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-45082","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6475-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0860","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-45082","description":"An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-18T23:23:30Z","modified":"2024-08-04T04:32:13.626Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2022-0040","description":"An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-18T23:23:30Z","modified":"2024-08-04T04:32:13Z","updated_at":"2026-11-03T03:08:28.023592Z"}],"ghsa":[{"id":"GHSA-6cm4-gm85-972c","title":"Command Injection in Cobbler","description":"An issue was discovered in Cobbler through 3.3.0. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-20T00:00:35Z","modified":"2024-09-06T15:47:49Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:38:01.080229Z"}],"nvd":[{"id":"CVE-2021-45082","description":"An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-19T00:15:17.013Z","modified":"2026-06-17T04:13:08.527Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:07:04.6896Z"}],"osv":[{"id":"CVE-2021-45082","description":"An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-19T00:15:17.013Z","modified":"2026-10-20T10:54:11.110907368Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"GHSA-6cm4-gm85-972c","title":"Command Injection in Cobbler","description":"An issue was discovered in Cobbler through 3.3.0. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-20T00:00:35Z","modified":"2026-09-10T03:49:16.868270938Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:39.618611Z"},{"id":"OESA-2025-1467","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:33Z","modified":"2026-08-18T01:18:50.235139876Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1468","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:50.29775514Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1469","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:23.263292787Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1527","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-16T11:08:37Z","modified":"2026-08-18T01:17:57.846852131Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2021-45082","description":"An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-19T00:15:00Z","modified":"2026-02-04T03:52:39.934704Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"openSUSE-SU-2024:11853-1","title":"cobbler-3.3.1.0+git.f5b0599a-1.1 on GA media","description":"These are all security issues fixed in the cobbler-3.3.1.0+git.f5b0599a-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:26:32.777734Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2022-37","description":"An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \"#from MODULE import\" substring. (Only lines beginning with #import are blocked.)","status":"published","published":"2022-02-19T00:15:00Z","modified":"2025-10-09T08:23:54.151503Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-SU-2022:0509-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).\n- CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).\n\nThe following non-security bugs were fixed:\n\n- Fix issues with installation module logging and validation (bsc#1195918)\n- Move configuration files ownership to apache (bsc#1195906)\n- Remove hardcoded test credentials (bsc#1193673)\n- Prevent log pollution (bsc#1193675)\n- Missing sanity check on MongoDB configuration file (bsc#1193676)  \n","status":"published","published":"2022-02-18T10:45:09Z","modified":"2026-02-04T02:13:47.205621Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0510-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).\n- CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).\n\nThe following non-security bugs were fixed:\n\n- Fix issues with installation module logging and validation (bsc#1195918)\n- Move configuration files ownership to apache (bsc#1195906)\n- Remove hardcoded test credentials (bsc#1193673)\n- Prevent log pollution (bsc#1193675)\n- Missing sanity check on MongoDB configuration file (bsc#1193676)\n","status":"published","published":"2022-02-18T10:45:23Z","modified":"2026-02-04T04:04:22.737413Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-6475-1","title":"cobbler vulnerabilities","description":"It was discovered that Cobbler did not properly handle user input, which\ncould result in an absolute path traversal. An attacker could possibly \nuse this issue to read arbitrary files. (CVE-2014-3225)\n\nIt was discovered that Cobbler did not properly handle user input, which\ncould result in command injection. An attacker could possibly use this \nissue to execute arbitrary code with high privileges. \n(CVE-2017-1000469, CVE-2021-45082)\n\nIt was discovered that Cobbler did not properly hide private functions in\na class. A remote attacker could possibly use this issue to gain high \nprivileges and upload files to an arbitrary location. \n(CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)\n\nNicolas Chatelain discovered that Cobbler did not properly handle user \ninput, which could result in log poisoning. A remote attacker could \npossibly use this issue to bypass authorization, write in an arbitrary \nfile, or execute arbitrary code. \n(CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)\n\nIt was discovered that Cobbler did not properly handle file permissions \nduring package install or update operations. An attacker could possibly \nuse this issue to perform a privilege escalation attack. (CVE-2021-45083)\n\nIt was discovered that Cobbler did not properly process credentials for \nexpired accounts. An attacker could possibly use this issue to login to \nthe platform with an expired account or password. (CVE-2022-0860)\n","status":"published","published":"2023-11-13T15:04:17Z","modified":"2026-06-25T13:31:28.777084885Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}