Skip to content
OpenAdvisories
High WID-SEC-2023-2926 3 CVEs

cobbler: Mehrere Schwachstellen

Published Feb 20, 2022 · Updated Nov 14, 2023 · Revision 3 · de-DE

Vendor: Ubuntu Product: Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cobbler ausnutzen, um Sicherheitsvorkehrungen zu umgehen und vertrauliche Informationen offenzulegen.

Product

Cobbler ist ein Linux Installationsserver, welcher die schnelle Einrichtung von Netzwerk-Installationsumgebungen ermöglicht.

Vulnerabilities 3

  • High 7.8
    CVE-2021-45082

    Command Injection in Cobbler

    An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

    cobbler cobbler Ubuntu PyPI
  • High 7.1
    CVE-2021-45083

    Incorrect Default Permissions in Cobbler

    An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains th…

    cobbler cobbler Ubuntu PyPI
  • Unscored —
    CVE-2021-45081

    An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more s…

    cobbler Ubuntu

Revision history

  1. #3

    Neue Updates von Ubuntu aufgenommen

  2. #2

    Neue Updates von Fedora aufgenommen

  3. #1

    Initiale Fassung

References