Skip to content
OpenAdvisories
Unscored RHSA-2012:1060 1 CVE

Red Hat Security Advisory: cobbler security update

Published Sep 15, 2024 · Updated Jan 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Network Satellite 5 network_satellite:5.4::el5 cobbler 0:2.0.7-14.6.el5sat
Red Hat · Network Satellite 5 network_satellite:5.4::el6 cobbler 0:2.0.7-14.6.el6sat

Vulnerabilities 1

  • High —
    CVE-2012-2395

    Cobbler subject to Command Injection

    Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.

    cobbler PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=824460
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1060.json
  • report
    https://access.redhat.com/security/cve/CVE-2012-2395
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2012-2395
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2012-2395