Description
Incomplete blacklist vulnerability in action_power.py in Cobbler 2.2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Satellite 5 | cobbler | 2.0.7-14.6.el5sat | RHSA-2012:1060 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP2 | cobbler | 3.1.2-bp152.4.3.1 | openSUSE-SU-2021:0058-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cobbler | 2.6.6-4.2 | openSUSE-SU-2024:10282-1 |
| openSUSE Leap 15.2 | cobbler | 3.1.2-lp152.6.3.1 | openSUSE-SU-2021:0046-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cobbler | < 2.6.0 | 2.6.0 | GHSA-g34c-mg6m-xvxj |
Advisories 4
- openSUSE-SU-2024:10282-1 cobbler-2.6.6-4.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0058-1 Security update for cobbler SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:0046-1 Security update for cobbler SUSE / openSUSE Security Updates · Feb 4, 2026
- RHSA-2012:1060 Red Hat Security Advisory: cobbler security update Red Hat Security Advisories (RHSA) · Jan 29, 2026
References
- SUSE-SU-2012:0814 vendor-advisory
- [oss-security] 20120523 CVE request: cobbler command injection mailing-list
- 53666 vdb-entry
- https://github.com/cobbler/cobbler/commit/6d9167e5da44eca56bdf42b5776097a6779aaadf
- [oss-security] 20120523 Re: CVE request: cobbler command injection mailing-list
- https://bugs.launchpad.net/ubuntu/+source/cobbler/+bug/978999
- https://github.com/cobbler/cobbler/issues/141
- openSUSE-SU-2012:0655 vendor-advisory
- 82458 vdb-entry