CVE-2016-9605 Cobbler Arbitrary File Read

What is CVE-2016-9605?

CVE-2016-9605 is a medium-severity path traversal vulnerability in The cobbler Project cobbler, published on 22 Aug 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.

Weakness: CWE-79

Which versions are affected by CVE-2016-9605?

3 open source packages ship an affected version, including cobbler. It affects 1 product.

Products include Cobbler Project Cobbler.

How do I fix CVE-2016-9605?

Apply the vendor's patch.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2016-9605 being exploited?

There is no known exploitation of CVE-2016-9605 in the wild and no public exploit code.

Other vulnerabilities in The cobbler Project cobbler

• CVE-2021-40323 Cobbler before 3.3.0 allows log poisoning Critical 9.8
• CVE-2018-10931 Cobbler has Exposed Dangerous Method or Function Critical 9.8
• CVE-2017-1000469 Cobbler vulnerable to arbitrary code execution Critical 9.8
• CVE-2022-0860 Improper Authorization in cobbler/cobbler High 8.2
• CVE-2021-45082 Command Injection in Cobbler High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4vc9-4xpq-77vm, PYSEC-2026-623, SUSE-SU-2017:1699-1.