CVE-2021-45082

CWE-77 — Command InjectionCWE-94 — Code Injection8 documents6 sources
Severity
7.8HIGH
EPSS
0.0%
top 86.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Cobbler Project CobblerFedoraproject FedoraOpensuse Backports+1 more
Timeline
PublishedFeb 19
Latest updateNov 13

Description

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶PyPIcobbler< 3.3.1
▶Ubuntucobbler< 2.4.1-0ubuntu2+esm1
▶NVDopensuse/backportssle-15

Also affects: Fedora 34, 35, 36

Patches

Patch: bugzilla.suse.com ↗Patch: bugzilla.suse.com ↗

🔴Vulnerability Details

5
OSV
cobbler vulnerabilities↗2023-11-13
▶
GHSA
Command Injection in Cobbler↗2022-02-20
▶
OSV
Command Injection in Cobbler↗2022-02-20
▶
OSV
CVE-2021-45082: An issue was discovered in Cobbler before 3↗2022-02-19
▶
CVEList
CVE-2021-45082: An issue was discovered in Cobbler before 3↗2022-02-18
▶

📋Vendor Advisories

2
Ubuntu
Cobbler vulnerabilities↗2023-11-13
▶
Red Hat
cobbler: incomplete template sanitization↗2022-02-18
▶