Cobbler Command Injection Vulnerability (CNVD-2022-18324)

Cobbler is a network installation server suite that is primarily used to quickly set up Linux network installations. A command injection vulnerability exists in versions of Cobbler prior to 3.3.1, stemming from the check_for_invalid_imports function in the templar.py file, which allows Cheetah code to import Python modules via the “#from MODULE import” substring to import Python modules. No detailed vulnerability details are available at this time.