critical9.0
CVE-2008-6954
Cobbler Web Interface Kickstart Template Remote Privilege Escalation Vulnerability
Impact
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | cobbler | < 1.2.9 | 1.2.9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Michael Dehaan | Cobbler | through 1.2.8 Versions 0.1.1.7, 0.2.1, 0.2.2, 0.2.3, 0.2.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://freshmeat.net/projects/cobbler/releases/288374
- http://osvdb.org/50291
- http://secunia.com/advisories/32737
- http://secunia.com/advisories/32804
- http://www.securityfocus.com/bid/32317
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46625
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.html
- https://www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.html
- https://github.com/advisories/GHSA-p8w2-f44p-fmcj
- https://nvd.nist.gov/vuln/detail/CVE-2008-6954
- https://web.archive.org/web/20111227125913/http://secunia.com/advisories/32804
- https://web.archive.org/web/20111227151912/http://secunia.com/advisories/32737
- https://web.archive.org/web/20200228143518/http://www.securityfocus.com/bid/32317