CVE-2021-45083
Fixed in a distro release EPSS <1%
An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.
Products: cobbler_project cobbler, fedoraproject fedora
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | cobbler | 3.3.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE HPE Helion OpenStack 8 | cobbler | 2.6.6-49.35.1 |
| SUSE Linux Enterprise Server 11 SP3-CLIENT-TOOLS | cobbler | 2.2.2-0.68.15.1 |
| SUSE Linux Enterprise Server 11 SP4-CLIENT-TOOLS | cobbler | 2.2.2-0.68.15.1 |
| SUSE Manager Client Tools 12 | cobbler | 2.6.6-49.35.1 |
| SUSE Manager Server Module 4.1 | cobbler | 3.0.0+git20190806.32c4bae0-8.22.9.1 |
| SUSE Manager Server Module 4.2 | cobbler | 3.1.2-150300.5.14.1 |
| SUSE OpenStack Cloud 8 | cobbler | 2.6.6-49.35.1 |
| SUSE OpenStack Cloud 9 | cobbler | 2.6.6-49.35.1 |
| Ubuntu Pro 16.04 LTS | cobbler | 2.4.1-0ubuntu2+esm1 |