CVE-2021-45082
Ubuntu Security Notice USN-6475-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
Se ha detectado un problema en Cobbler versiones hasta 3.3.0. En el archivo templar.py, la función check_for_invalid_imports puede permitir que el código Cheetah importe módulos de Python por medio de la subcadena "#from MODULE import". (Sólo son bloqueadas las líneas que comienzan con #import)
An update that solves 6 vulnerabilities and has 6 fixes is now available. This update for cobbler fixes the following issues. Fixed unsafe permissions on sensitive files. Fixed incomplete template sanitation. Fixed Remote Code Execution in the XMLRPC API which additionally allowed arbitrary file read and write as root. The following non-security bugs were fixed. Boot_loader is not set destination directory is not existing.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-12-16 CVE Reserved
- 2022-02-18 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-07-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/cobbler/cobbler/releases | Release Notes |
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=1193678 | 2024-08-04 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Cobbler Project Search vendor "Cobbler Project" | Cobbler Search vendor "Cobbler Project" for product "Cobbler" | < 3.3.1 Search vendor "Cobbler Project" for product "Cobbler" and version " < 3.3.1" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Factory Search vendor "Opensuse" for product "Factory" | - | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Backports Search vendor "Opensuse" for product "Backports" | sle-15 Search vendor "Opensuse" for product "Backports" and version "sle-15" | sp3 |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Backports Search vendor "Opensuse" for product "Backports" | sle-15 Search vendor "Opensuse" for product "Backports" and version "sle-15" | sp4 |
Affected
| ||||||
| Suse Search vendor "Suse" | Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server" | 11 Search vendor "Suse" for product "Linux Enterprise Server" and version "11" | sp3 |
Affected
| ||||||
| Suse Search vendor "Suse" | Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server" | 12 Search vendor "Suse" for product "Linux Enterprise Server" and version "12" | - |
Affected
| ||||||
| Suse Search vendor "Suse" | Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server" | 15 Search vendor "Suse" for product "Linux Enterprise Server" and version "15" | sp2 |
Affected
| ||||||
| Suse Search vendor "Suse" | Linux Enterprise Server Search vendor "Suse" for product "Linux Enterprise Server" | 15 Search vendor "Suse" for product "Linux Enterprise Server" and version "15" | sp3 |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 35 Search vendor "Fedoraproject" for product "Fedora" and version "35" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 36 Search vendor "Fedoraproject" for product "Fedora" and version "36" | - |
Affected
| ||||||