CVE-2021-45082 Command Injection in Cobbler
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2021-45082?
CVE-2021-45082 is a high-severity vulnerability in Fedoraproject Fedora, published on 18 Feb 2022.
Official description
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
Weakness: CWE-77
Which versions are affected by CVE-2021-45082?
3 open source packages ship an affected version, including cobbler. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
cobbler PyPI | All versions | 3.3.1 |
cobbler PyPI | All versions | 3.3.1 |
cobbler PyPI | All versions | 3.3.1 |
Linux distribution packages (1)
cobbler openSUSE:Tumbleweed | All versions | 3.3.1.0+git.f5b0599a-1.1 |
Products include Cobbler Project Cobbler, Fedoraproject Fedora, Opensuse Backports, Opensuse Factory, Suse Linux Enterprise Server.
How do I fix CVE-2021-45082?
Upgrade cobbler to 3.3.1 or later.
Is CVE-2021-45082 being exploited?
There is no known exploitation of CVE-2021-45082 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
- CVE-2021-40323 Cobbler before 3.3.0 allows log poisoning
- CVE-2018-10931 Cobbler has Exposed Dangerous Method or Function
- CVE-2017-1000469 Cobbler vulnerable to arbitrary code execution
- CVE-2022-0860 Improper Authorization in cobbler/cobbler
- CVE-2021-40324 Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Sources
Also known as GHSA-6cm4-gm85-972c, PYSEC-2022-37, UBUNTU-CVE-2021-45082, openSUSE-SU-2024:11853-1.