Description
Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | cobbler | 2.4.1-0ubuntu2+esm1 | USN-6475-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.2 | cobbler | 3.1.2-5.8.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | cpu-mitigations-formula | 0.4.0-3.3.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | inter-server-sync | 0.0.5-8.3.2 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | openvpn-formula | 0.1.2-3.3.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | prometheus-exporters-formula | 1.0.3-3.6.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | py26-compat-salt | 2016.11.10-11.28.6.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | py27-compat-salt | 3000.3-7.7.8.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | saltboot-formula +1 | 0.1.1628156312.dbd0dec-3.3.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacecmd | 4.2.12-4.6.2 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacewalk-backend | 4.2.16-4.6.3 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacewalk-certs-tools | 4.2.12-3.6.2 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacewalk-client-tools | 4.2.13-4.6.3 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacewalk-java | 4.2.28-3.11.5 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacewalk-setup +1 | 4.2.8-3.6.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacewalk-utils | 4.2.13-3.6.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | spacewalk-web | 4.2.21-3.6.3 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | susemanager | 4.2.22-3.6.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | susemanager-build-keys | 15.3.5-3.3.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | susemanager-docs_en +1 | 4.2-12.8.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | susemanager-schema | 4.2.17-3.6.2 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.2 | susemanager-sls | 4.2.16-3.6.1 | SUSE-SU-2021:3170-1 |
| SUSE Manager Server Module 4.1 | cobbler | 3.0.0+git20190806.32c4bae0-8.22.6.1 | SUSE-SU-2021:3151-1 |
| SUSE Manager Server 4.2 | release-notes-susemanager | 4.2.2-3.12.1 | SUSE-RU-2021:3162-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Retail Branch Server 4.2 | release-notes-susemanager-proxy | 4.2.2-3.12.1 | SUSE-RU-2021:3162-1 |
| SUSE Manager Proxy 4.2 | release-notes-susemanager-proxy | 4.2.2-3.12.1 | SUSE-RU-2021:3162-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cobbler | < 3.3.0 | 3.3.0 | GHSA-4cfr-gjfx-fj3x |
Advisories 5
- USN-6475-1 cobbler vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- SUSE-SU-2021:3170-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2021:3162-1 Recommended update for SUSE Manager 4.2.2 Release Notes SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3151-1 Security update for cobbler SUSE / openSUSE Security Updates · May 2, 2025
- WID-SEC-2023-2927 cobbler: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 14, 2023