Description
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | cobbler | 2.4.1-0ubuntu2+esm1 | USN-6475-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.2 | cobbler | 3.1.2-150300.5.14.1 | SUSE-SU-2022:0509-1 |
| SUSE Manager Server Module 4.1 | cobbler | 3.0.0+git20190806.32c4bae0-8.22.9.1 | SUSE-SU-2022:0510-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | cobbler | 3.3.1.0+git.f5b0599a-1.1 | openSUSE-SU-2024:11853-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | cobbler | < 3.3.1 | 3.3.1 | GHSA-6cm4-gm85-972c |
Advisories 5
- USN-6475-1 cobbler vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2024:11853-1 cobbler-3.3.1.0+git.f5b0599a-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0510-1 Security update for cobbler SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:0509-1 Security update for cobbler SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2926 cobbler: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 14, 2023
References
- https://github.com/cobbler/cobbler/releases
- https://bugzilla.suse.com/show_bug.cgi?id=1193678
- FEDORA-2022-0c6402a6a3 vendor-advisory
- FEDORA-2022-0649006be6 vendor-advisory
- FEDORA-2022-f1510aa454 vendor-advisory