{"id":"CVE-2021-45083","aliases":["EUVD-2022-0041","GHSA-5946-mpw5-pqxx","OESA-2025-1467","OESA-2025-1468","OESA-2025-1469","OESA-2025-1527","PYSEC-2022-38","SUSE-FU-2022:0750-1","SUSE-SU-2022:0507-1","SUSE-SU-2022:0509-1","SUSE-SU-2022:0510-1","SUSE-SU-2022:14891-1","UBUNTU-CVE-2021-45083","USN-6475-1"],"status":"published","title":"Incorrect Default Permissions in Cobbler","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00311,"percentile":0.24124,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2022-02-18T10:44:04Z","modified":"2026-10-20T10:54:11Z","fixes":[{"ecosystem":"PyPI","package":"cobbler","fixed_in":["3.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cobbler","fixed_in":["2.6.6-49.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"cobbler","fixed_in":["2.6.6-49.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"cobbler","fixed_in":["2.6.6-49.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"cobbler","fixed_in":["2.6.6-49.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"cobbler","fixed_in":["2.2.2-0.68.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"cobbler","fixed_in":["2.2.2-0.68.15.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","fixed_in":["2.4.1-0ubuntu2+esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}],"versions":["0.6.3-2","3.1.2","3.2.1","3.2.2","3.2.3","3.3.0"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2203sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-2.oe2403"}]}],"bundled":5},{"source":"osv","ecosystem":"PyPI","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1"}]}],"versions":["0.6.3-2","3.1.2","3.2.1","3.2.2","3.3.0","3.2.3"]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-49.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-49.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-49.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.6-49.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.2","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-150300.5.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server Module 4.1","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.0+git20190806.32c4bae0-8.22.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-CLIENT-TOOLS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0.68.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-CLIENT-TOOLS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-0.68.15.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-0ubuntu2+esm1"}]}],"versions":["2.4.1-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cobbler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-0ubuntu2+esm1"}]}],"versions":["2.4.1-0ubuntu2"],"bundled":11}],"products":[{"vendor":"cobbler_project","product":"cobbler"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/cobbler/cobbler/releases","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/02/18/3","tags":["x_refsource_MISC","x_transferred","Mailing List","Mitigation","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1193671","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45083","tags":["advisory"]},{"url":"https://github.com/cobbler/cobbler/pull/2945","tags":["web"]},{"url":"https://github.com/cobbler/cobbler/releases/tag/v3.3.1","tags":["web"]},{"url":"https://github.com/cobbler/cobbler/commit/10b2112db83fedfc391e900edfedc2b4e507d3f7","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5946-mpw5-pqxx","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2022-38.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE","tags":["web"]},{"url":"https://github.com/cobbler/cobbler","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1467","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-40324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45082","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1468","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1469","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1527","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2022-750/suse-fu-20220750-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1097531","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1190462","tags":["report"]},{"url":"https://bugzilla.suse.com/1190781","tags":["report"]},{"url":"https://bugzilla.suse.com/1193357","tags":["report"]},{"url":"https://bugzilla.suse.com/1193565","tags":["report"]},{"url":"https://bugzilla.suse.com/1193671","tags":["report"]},{"url":"https://bugzilla.suse.com/1194363","tags":["report"]},{"url":"https://bugzilla.suse.com/1195906","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45083","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220507-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220509-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193673","tags":["report"]},{"url":"https://bugzilla.suse.com/1193675","tags":["report"]},{"url":"https://bugzilla.suse.com/1193676","tags":["report"]},{"url":"https://bugzilla.suse.com/1193678","tags":["report"]},{"url":"https://bugzilla.suse.com/1195918","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45082","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220510-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214891-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-45083","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6475-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45083","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000226","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40323","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-40325","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-45082","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0860","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-45083","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-20T17:56:11Z","modified":"2024-08-04T04:32:13.664Z","updated_at":"2026-11-02T14:33:02.580561Z"}],"euvd":[{"id":"EUVD-2022-0041","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-20T17:56:11Z","modified":"2024-08-04T04:32:13Z","updated_at":"2026-11-03T03:08:28.023592Z"}],"ghsa":[{"id":"GHSA-5946-mpw5-pqxx","title":"Incorrect Default Permissions in Cobbler","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-21T00:00:20Z","modified":"2024-09-13T18:30:45Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:38:02.773864Z"}],"nvd":[{"id":"CVE-2021-45083","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-20T18:15:07.58Z","modified":"2026-06-17T04:13:08.657Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:07:04.6896Z"}],"osv":[{"id":"CVE-2021-45083","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-20T18:15:07.58Z","modified":"2026-10-20T10:54:11.086957782Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"GHSA-5946-mpw5-pqxx","title":"Incorrect Default Permissions in Cobbler","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-21T00:00:20Z","modified":"2026-09-10T03:49:11.546482966Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"OESA-2025-1467","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:33Z","modified":"2026-08-18T01:18:50.235139876Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1468","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:50.29775514Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1469","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-09T11:08:34Z","modified":"2026-08-18T01:18:23.263292787Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1527","title":"cobbler security update","description":"Cobbler is a network install server. Cobbler supports PXE, ISO virtualized installs, and re-installing existing Linux machines. The last two modes use a helper tool, \u0026amp;apos;koan\u0026amp;apos;, that integrates with cobbler. Cobbler\u0026amp;apos;s advanced features include importing distributions from DVDs and rsync mirrors, kickstart templating, integrated yum mirroring, and built-in DHCP/DNS Management. Cobbler has a XML-RPC API for integration with other applications.\r\n\r\nSecurity Fix(es):\n\nCobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.(CVE-2021-40323)\n\nCobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.(CVE-2021-40324)\n\nAn issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.(CVE-2021-45081)\n\nAn issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the \u0026quot;#from MODULE import\u0026quot; substring. (Only lines beginning with #import are blocked.)(CVE-2021-45082)\n\nAn issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it\u0026apos;s trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.(CVE-2021-45083)","status":"published","published":"2025-05-16T11:08:37Z","modified":"2026-08-18T01:17:57.846852131Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2021-45083","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-20T18:15:00Z","modified":"2026-02-04T02:35:00.099808Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:30.277322Z"},{"id":"PYSEC-2022-38","description":"An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.","status":"published","published":"2022-02-20T18:15:00Z","modified":"2025-10-09T08:23:55.020259Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-FU-2022:0750-1","title":"Feature update for SUSE Manager Client Tools","description":"This feature update fixes the following issues:\n\ncobbler:\n\n- Move configuration files ownership to apache (bsc#1195906) \n- Make configuration files only readable by root (bsc#1193671, CVE-2021-45083)\n\ngolang-github-prometheus-prometheus:\n\n- Upgrade to upstream version 2.32.1 (jsc#SLE-22863)\n  + Bugfixes:\n    * Scrape: Fix reporting metrics when sample limit is reached\n      during the report. #9996\n    * Scrape: Ensure that scrape interval and scrape timeout are\n      always set. #10023\n    * TSDB: Expose and fix bug in iterators' Seek() method. #10030\n- Upgrade to upstream version 2.32.0\n  + Change:\n    * remote-write: Change default max retry time from 100ms to\n      5 seconds. #9634\n  + Features:\n    * Agent: New mode of operation optimized for remote-write only\n      scenarios, without local storage.\n    * Promtool: Add promtool check service-discovery command. #8970\n  + Enhancements:\n    * Promtool: Improve test output. #8064\n    * Promtool: Use kahan summation for better numerical stability.\n    * Remote-write: Reuse memory for marshalling. #9412\n    * Scrape: Add scrape_body_size_bytes scrape metric behind the\n      --enable-feature=extra-scrape-metrics flag. #9569\n    * TSDB: Add windows arm64 support. #9703\n    * TSDB: Optimize query by skipping unneeded sorting in TSDB.\n    * Templates: Support int and uint as datatypes for template\n      formatting. #9680\n    * UI: Prefer rate over rad, delta over deg, and count over cos\n      in autocomplete. #9688\n    * TSDB: Add more size checks when writing individual sections\n      in the index. #9710\n    * PromQL: Make deriv() return zero values for constant series.\n    * TSDB: Fix panic when checkpoint directory is empty. #9687\n    * TSDB: Fix panic, out of order chunks, and race warning during\n      WAL replay. #9856\n    * UI: Correctly render links for targets with IPv6 addresses\n      that contain a Zone ID. #9853\n    * Promtool: Fix checking of authorization.credentials_file and\n      bearer_token_file fields. #9883\n    * Uyuni SD: Fix null pointer exception during initialization.\n    * TSDB: Fix queries after a failed snapshot replay. #9980\n- Upgrade to upstream version 2.31.1\n  + Bugfix:\n    * SD: Fix a panic when the experimental discovery manager\n      receives targets during a reload. #9656\n- Upgrade to upstream version 2.31.0\n    * UI: Remove standard PromQL editor in favour of the\n      codemirror-based editor. #9452\n    * PromQL: Add trigonometric functions and atan2 binary\n      operator. #9239 #9248 #9515\n    * Remote: Add support for exemplar in the remote write receiver\n      endpoint. #9319 #9414\n    * SD: Add PuppetDB service discovery. #8883\n    * SD: Add Uyuni service discovery. #8190\n    * Web: Add support for security-related HTTP headers. #9546\n    * Azure SD: Add proxy_url, follow_redirects, tls_config. #9267\n    * Backfill: Add --max-block-duration in promtool\n      create-blocks-from rules. #9511\n    * Config: Print human-readable sizes with unit instead of raw\n      numbers. #9361\n    * HTTP: Re-enable HTTP/2. #9398\n    * Kubernetes SD: Warn user if number of endpoints exceeds\n      limit. #9467\n    * OAuth2: Add TLS configuration to token requests. #9550\n    * PromQL: Several optimizations. #9365 #9360 #9362 #9552\n    * PromQL: Make aggregations deterministic in instant queries.\n    * Rules: Add the ability to limit number of alerts or series.\n    * SD: Experimental discovery manager to avoid restarts upon\n      reload.\n    * UI: Debounce timerange setting changes. #9359\n    * Backfill: Apply rule labels after query labels. #9421\n    * Scrape: Resolve conflicts between multiple exported label\n      prefixes. #9479 #9518\n    * Scrape: Restart scrape loops when __scrape_interval__ is\n      changed. #9551\n    * TSDB: Fix memory leak in samples deletion. #9151\n    * UI: Use consistent margin-bottom for all alert kinds. #9318\n- Upgrade to upstream version 2.30.3\n    * TSDB: Fix panic on failed snapshot replay. #9438\n    * TSDB: Don't fail snapshot replay with exemplar storage\n      disabled when the snapshot contains exemplars. #9438\n- Upgrade to upstream version 2.30.2\n    * TSDB: Don't error on overlapping m-mapped chunks during WAL\n      replay. #9381\n- Upgrade to upstream version 2.30.1\n    * Remote Write: Redact remote write URL when used for metric\n      label. #9383\n    * UI: Redact remote write URL and proxy URL passwords in the\n      /config page. #9408\n    * promtool rules backfill: Prevent creation of data before the\n      start time. #9339\n    * promtool rules backfill: Do not query after the end time.\n    * Azure SD: Fix panic when no computername is set. #9387\n- Upgrade to upstream version 2.30.0\n    * experimental TSDB: Snapshot in-memory chunks on shutdown for\n      faster restarts. #7229\n    * experimental Scrape: Configure scrape interval and scrape\n      timeout via relabeling using __scrape_interval__ and\n      __scrape_timeout__ labels respectively. #8911\n    * Scrape: Add scrape_timeout_seconds and scrape_sample_limit\n      metric. #9247 #9295\n    * Scrape: Add --scrape.timestamp-tolerance flag to adjust\n      scrape timestamp tolerance when enabled via\n      --scrape.adjust-timestamps. #9283\n    * Remote Write: Improve throughput when sending exemplars.\n    * TSDB: Optimise WAL loading by removing extra map and caching\n      min-time #9160\n    * promtool: Speed up checking for duplicate rules. #9262/#9306\n    * Scrape: Reduce allocations when parsing the metrics. #9299\n    * docker_sd: Support host network mode #9125\n    * Exemplars: Fix panic when resizing exemplar storage from 0 to\n      a non-zero size. #9286\n    * TSDB: Correctly decrement\n      prometheus_tsdb_head_active_appenders when the append has no\n      samples. #9230\n    * promtool rules backfill: Return 1 if backfill was\n      unsuccessful. #9303\n    * promtool rules backfill: Avoid creation of overlapping\n      blocks. #9324\n    * config: Fix a panic when reloading configuration with a null\n      relabel action. #9224\n- Upgrade to upstream version 2.29.2\n    * Fix Kubernetes SD failing to discover Ingress in\n      Kubernetes v1.22. #9205\n    * Fix data race in loading write-ahead-log (WAL). #9259\n- Upgrade to upstream version 2.29.1\n    * TSDB: align atomically accessed int64 to prevent panic in\n      32-bit archs. #9192\n- Upgrade to upstream version 2.29.0\n  + Changes:\n    * Promote --storage.tsdb.allow-overlapping-blocks flag to\n      stable. #9117\n    * Promote --storage.tsdb.retention.size flag to stable. #9004\n    * Add Kuma service discovery. #8844\n    * Add present_over_time PromQL function. #9097\n    * Allow configuring exemplar storage via file and make it\n      reloadable. #8974\n    * UI: Allow selecting time range with mouse drag. #8977\n    * promtool: Add feature flags flag --enable-feature. #8958\n    * promtool: Add file_sd file validation. #8950\n    * Reduce blocking of outgoing remote write requests from series\n      garbage collection. #9109\n    * Improve write-ahead-log decoding performance. #9106\n    * Improve append performance in TSDB by reducing mutexes usage.\n    * Allow configuring max_samples_per_send for remote write\n      metadata. #8959\n    * Add __meta_gce_interface_ipv4_\u003cname\u003e meta label to GCE\n      discovery. #8978\n    * Add __meta_ec2_availability_zone_id meta label to EC2\n      discovery. #8896\n    * Add __meta_azure_machine_computer_name meta label to Azure\n      discovery. #9112\n    * Add __meta_hetzner_hcloud_labelpresent_\u003clabelname\u003e meta label\n      to Hetzner discovery. #9028\n    * promtool: Add compaction efficiency to promtool tsdb analyze\n      reports. #8940\n    * promtool: Allow configuring max block duration for\n      backfilling via --max-block-duration flag. #8919\n    * UI: Add sorting and filtering to flags page. #8988\n    * UI: Improve alerts page rendering performance. #9005\n    * Log when total symbol size exceeds 2^32 bytes, causing\n      compaction to fail, and skip compaction. #9104\n    * Fix incorrect target_limit reloading of zero value. #9120\n    * Fix head GC and pending readers race condition. #9081\n    * Fix timestamp handling in OpenMetrics parser. #9008\n    * Fix potential duplicate metrics in /federate endpoint when\n      specifying multiple matchers. #8885\n    * Fix server configuration and validation for authentication\n      via client cert. #9123\n    * Allow start and end again as label names in PromQL queries.\n      They were disallowed since the introduction of @ timestamp\n      feature. #9119\n- Upgrade to upstream version 2.28.1\n    * HTTP SD: Allow charset specification in Content-Type header.\n    * HTTP SD: Fix handling of disappeared target groups. #9019\n    * Fix incorrect log-level handling after moving to go-kit/log.\n- Upgrade to upstream version 2.28.0\n    * UI: Make the new experimental PromQL editor the default.\n    * Linode SD: Add Linode service discovery. #8846\n    * HTTP SD: Add generic HTTP-based service discovery. #8839\n    * Kubernetes SD: Allow configuring API Server access via a\n      kubeconfig file. #8811\n    * UI: Add exemplar display support to the graphing interface.\n    * Consul SD: Add namespace support for Consul Enterprise. #8900\n    * Promtool: Allow silencing output when importing / backfilling\n      data. #8917\n    * Consul SD: Support reading tokens from file. #8926\n    * Rules: Add a new .ExternalURL alert field templating\n      variable, containing the external URL of the Prometheus\n      server. #8878\n    * Scrape: Add experimental body_size_limit scrape configuration\n      setting to limit the allowed response body size for target\n      scrapes. #8833 #8886\n    * Kubernetes SD: Add ingress class name label for ingress\n      discovery. #8916\n    * UI: Show a startup screen with progress bar when the TSDB is\n      not ready yet. #8662 #8908 #8909 #8946\n    * SD: Add a target creation failure counter\n      prometheus_target_sync_failed_total and improve target\n      creation failure handling. #8786\n    * TSDB: Improve validation of exemplar label set length. #8816\n    * TSDB: Add a prometheus_tsdb_clean_start metric that indicates\n      whether a TSDB lockfile from a previous run still existed\n      upon startup. #8824\n    * UI: In the experimental PromQL editor, fix autocompletion and\n      parsing for special float values and improve series metadata\n      fetching. #8856\n    * TSDB: When merging chunks, split resulting chunks if they\n      would contain more than the maximum of 120 samples. #8582\n    * SD: Fix the computation of the\n      prometheus_sd_discovered_targets metric when using multiple\n      service discoveries. #8828\n- Added hardening to systemd service(s) (bsc#1181400). Modified:\n\nmgr-cfg:\n\n- Version 4.3.4-1\n  * Fix installation problem for SLE15SP4 due missing python-selinux\n\nsalt:\n\n- Fix inspector module export function (bsc#1097531)\n- Wipe NOTIFY_SOCKET from env in cmdmod (bsc#1193357)\n- Fix possible traceback on ip6_interface grain (bsc#1193565)\n- Don't check for cached pillar errors on state.apply (bsc#1190781)\n- Simplify 'transactional_update' module to not use SSH wrapper and allow more flexible execution\n- Add '--no-return-event' option to salt-call to prevent sending return event back to master.\n- Make 'state.highstate' to acts on concurrent flag.\n\nspacecmd:\n\n- Version 4.3.7-1\n  * Include group formulas configuration in spacecmd group_backup and\n    spacecmd group_restore. This changes backup format to json,\n    previously used plain text is still supported for reading (bsc#1190462)\n  * Fix interactive mode for 'system_applyerrata' and 'errata_apply' (bsc#1194363)\n- Version 4.3.6-1\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 4.3.6-1\n  * Update translation strings\n\n","status":"published","published":"2022-03-08T11:26:06Z","modified":"2026-02-04T04:13:53.983773Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2022:0507-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).\n\nThe following non-security bugs were fixed:\n\n- Move configuration files ownership to apache (bsc#1195906) \n","status":"published","published":"2022-02-18T10:44:04Z","modified":"2026-02-04T03:38:36.711199Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0509-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).\n- CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).\n\nThe following non-security bugs were fixed:\n\n- Fix issues with installation module logging and validation (bsc#1195918)\n- Move configuration files ownership to apache (bsc#1195906)\n- Remove hardcoded test credentials (bsc#1193673)\n- Prevent log pollution (bsc#1193675)\n- Missing sanity check on MongoDB configuration file (bsc#1193676)  \n","status":"published","published":"2022-02-18T10:45:09Z","modified":"2026-02-04T02:13:47.205621Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0510-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).\n- CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678).\n\nThe following non-security bugs were fixed:\n\n- Fix issues with installation module logging and validation (bsc#1195918)\n- Move configuration files ownership to apache (bsc#1195906)\n- Remove hardcoded test credentials (bsc#1193673)\n- Prevent log pollution (bsc#1193675)\n- Missing sanity check on MongoDB configuration file (bsc#1193676)\n","status":"published","published":"2022-02-18T10:45:23Z","modified":"2026-02-04T04:04:22.737413Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:14891-1","title":"Security update for cobbler","description":"This update for cobbler fixes the following issues:\n\n- CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671).\n\nThe following non-security bugs were fixed:\n\n- Move configuration files ownership to apache (bsc#1195906)\n","status":"published","published":"2022-02-18T10:44:54Z","modified":"2026-02-04T04:03:08.307409Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-6475-1","title":"cobbler vulnerabilities","description":"It was discovered that Cobbler did not properly handle user input, which\ncould result in an absolute path traversal. An attacker could possibly \nuse this issue to read arbitrary files. (CVE-2014-3225)\n\nIt was discovered that Cobbler did not properly handle user input, which\ncould result in command injection. An attacker could possibly use this \nissue to execute arbitrary code with high privileges. \n(CVE-2017-1000469, CVE-2021-45082)\n\nIt was discovered that Cobbler did not properly hide private functions in\na class. A remote attacker could possibly use this issue to gain high \nprivileges and upload files to an arbitrary location. \n(CVE-2018-10931, CVE-2018-1000225, CVE-2018-1000226)\n\nNicolas Chatelain discovered that Cobbler did not properly handle user \ninput, which could result in log poisoning. A remote attacker could \npossibly use this issue to bypass authorization, write in an arbitrary \nfile, or execute arbitrary code. \n(CVE-2021-40323, CVE-2021-40324, CVE-2021-40325)\n\nIt was discovered that Cobbler did not properly handle file permissions \nduring package install or update operations. An attacker could possibly \nuse this issue to perform a privilege escalation attack. (CVE-2021-45083)\n\nIt was discovered that Cobbler did not properly process credentials for \nexpired accounts. An attacker could possibly use this issue to login to \nthe platform with an expired account or password. (CVE-2022-0860)\n","status":"published","published":"2023-11-13T15:04:17Z","modified":"2026-06-25T13:31:28.777084885Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}