Skip to content
OpenAdvisories
High · 7.1 CVE-2021-45083 EUVD-2022-0041GHSA-5946-mpw5-pqxxPYSEC-2022-38

Incorrect Default Permissions in Cobbler

Published Feb 20, 2022 · Updated Aug 4, 2024 · Assigned by mitre

Package: cobbler Package: cobbler Ecosystem: PyPI Ecosystem: Ubuntu

Description

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS cobbler 2.4.1-0ubuntu2+esm1 USN-6475-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 11 SP4 cobbler 2.2.2-0.68.15.1 SUSE-SU-2022:14891-1
SLES 11 SP3 cobbler 2.2.2-0.68.15.1 SUSE-SU-2022:14891-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE OpenStack Cloud 9 cobbler 2.6.6-49.35.1 SUSE-SU-2022:0507-1
SUSE OpenStack Cloud 8 cobbler 2.6.6-49.35.1 SUSE-SU-2022:0507-1
SUSE Manager Server Module 4.2 cobbler 3.1.2-150300.5.14.1 SUSE-SU-2022:0509-1
SUSE Manager Server Module 4.1 cobbler 3.0.0+git20190806.32c4bae0-8.22.9.1 SUSE-SU-2022:0510-1
SUSE Manager Client Tools 12 cobbler 2.6.6-49.35.1 SUSE-SU-2022:0507-1
SUSE HPE Helion OpenStack 8 cobbler 2.6.6-49.35.1 SUSE-SU-2022:0507-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI cobbler < 3.3.1 3.3.1 GHSA-5946-mpw5-pqxx

Advisories 6

References