Description
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cobbler | < 1.2.9 | 1.2.9 | GHSA-p8w2-f44p-fmcj |
References
- FEDORA-2008-9723 vendor-advisory
- 50291 vdb-entry
- FEDORA-2008-9745 vendor-advisory
- 32804 third-party-advisory
- 32737 third-party-advisory
- cobbler-interface-code-execution(46625) vdb-entry
- 32317 vdb-entry
- http://freshmeat.net/projects/cobbler/releases/288374