Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

SUSE CVE-2018-10931

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon...

GHSA-F88Q-22G8-FRCG Cobbler Improper Validation of Security Tokens

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

SUSE: Security Advisory (SUSE-SU-2018:2550-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for cobbler FEDORA-2019-502f1a2c67

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 31 : cobbler (2019-502f1a2c67)

Update to current release. Python3 compatible Installable with f31+ ---- Update to 2.5.0 pre-release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much ...

Fedora 29 : cobbler (2019-cd24f60a94)

Update to 2.5.0 pre-release Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

Fedora 28 : cobbler (2018-1d2a79fe1c)

Fix empty man pages ---- - Revert bindmanageipmi feature that is broken on 2.8 - Use pathfix.py to fix python shebangs ---- - Update to 2.8.4 Fixes BZ 1613292, 1643860, 1614433, CVE-2018-1000226, CVE-2018-10931 - Make koan require python2-ethtool BZ 1638933 Note that Tenable Network Security has...

openSUSE: Security Advisory for cobbler (openSUSE-SU-2018:2590-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SUSE SLES11 Security Update : cobbler (SUSE-SU-2018:2550-1)

This update for cobbler fixes the following issues: Security issue fixed : - CVE-2018-10931: Forbid exposure of private methods in the API bsc1104287, bsc1104189 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has...

Security update for cobbler (important)

This update for cobbler fixes the following issues: Security issues fixed: - Forbid exposure of private methods in the API CVE-2018-10931, CVE-2018-1000225, bsc1104287, bsc1104189, bsc1105442 - Check access token when calling 'modifysetting' API endpoint bsc1104190, bsc1105440, CVE-2018-1000226...

SUSE-SU-2018:2550-1 Security update for cobbler

This update for cobbler fixes the following issues: Security issue fixed: - CVE-2018-10931: Forbid exposure of private methods in the API bsc1104287, bsc1104189...

Design/Logic Flaw

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

RHEL 6 : cobbler (RHSA-2018:2372)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:2372 advisory. Cobbler is a network install server. Cobbler supports PXE, virtualized installs, and re-installing existing Linux machines. Cobbler has a XMLRPC API...

CVE-2018-10931

CVE-2018-10931 affects Cobbler 2.6.x where CobblerXMLRPCInterface private functions were exposed over XMLRPC. This allowed remote, unauthenticated attackers to gain high-privilege access within Cobbler and upload files to arbitrary locations in the daemon context. Related advisories note an authe...

Critical: Red Hat Security Advisory: cobbler security update

An update for cobbler is now available for Red Hat Satellite 5.6, Red Hat Satellite 5.7, and Red Hat Satellite 5.8. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating...

CVE-2018-10931

An API-exposure flaw was found in cobbler, where it exported CobblerXMLRPCInterface private functions over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain important privileges within cobbler, as well as upload files to an arbitrary location in the daemon context. Mitigation...