critical9.8
CVE-2021-40323
Cobbler before 3.3.0 allows log poisoning
Impact
Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | cobbler | < 3.3.0 | 3.3.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cobbler Project | Cobbler | through 3.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/cobbler/cobbler/commit/d8f60bbf14a838c8c8a1dba98086b223e35fe70a
- https://github.com/cobbler/cobbler/releases/tag/v3.3.0
- https://github.com/advisories/GHSA-cpqf-3c3r-c9g2
- https://nvd.nist.gov/vuln/detail/CVE-2021-40323
- https://github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2021-373.yaml