Cobbler

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. `utils.get_shared_secret()` always returns `-1`, which allows anyone to connect to cobbler XML-RPC as user `''` password `-1` and make any changes. This gives anyone with network access to a cobbler server full control of the server. Versions 3.2.3 and 3.3.7 fix the issue.

Published: 2024-11-18T16:33:55.229Z
Updated: 2024-11-18T18:24:07.378Z

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

Published: 2022-03-11T12:50:10.000Z
Updated: 2024-08-02T23:40:04.519Z

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

Published: 2022-02-20T17:56:11.000Z
Updated: 2024-08-04T04:32:13.664Z

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

Published: 2022-02-18T23:23:30.000Z
Updated: 2024-08-04T04:32:13.626Z

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.

Published: 2022-02-20T17:52:52.000Z
Updated: 2024-08-04T04:32:13.705Z