Security update for cobbler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3151-1 Final 1 1 2021-09-20T15:21:44Z current 2021-09-20T15:21:44Z 2021-09-20T15:21:44Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cobbler This update for cobbler fixes the following issues: Security issues fixed: - CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection (bsc#1189458) - CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458) - CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458) - Please note that with these changes, a valid log data from Anamon (Red Hat Autoinstallation Process) uploaded to cobbler may be rejected The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure-2021-3151,Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM-2021-3151,Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE-2021-3151,SUSE-2021-3151,SUSE-SLE-Module-SUSE-Manager-Server-4.1-2021-3151 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213151-1/ Link for SUSE-SU-2021:3151-1 https://lists.suse.com/pipermail/sle-security-updates/2021-September/009468.html E-Mail link for SUSE-SU-2021:3151-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1189458 SUSE Bug 1189458 https://www.suse.com/security/cve/CVE-2021-40323/ SUSE CVE CVE-2021-40323 page https://www.suse.com/security/cve/CVE-2021-40324/ SUSE CVE CVE-2021-40324 page https://www.suse.com/security/cve/CVE-2021-40325/ SUSE CVE CVE-2021-40325 page Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE SUSE Manager Server Module 4.1 cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 cobbler-tests-3.0.0+git20190806.32c4bae0-8.22.6.1 cobbler-web-3.0.0+git20190806.32c4bae0-8.22.6.1 cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 as a component of Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 as a component of SUSE Manager Server Module 4.1 Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection. CVE-2021-40323 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 SUSE Manager Server Module 4.1:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213151-1/ https://www.suse.com/security/cve/CVE-2021-40323.html CVE-2021-40323 https://bugzilla.suse.com/1189458 SUSE Bug 1189458 Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. CVE-2021-40324 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 SUSE Manager Server Module 4.1:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213151-1/ https://www.suse.com/security/cve/CVE-2021-40324.html CVE-2021-40324 Cobbler before 3.3.0 allows authorization bypass for modification of settings. CVE-2021-40325 Image SLES15-SP2-Manager-4-1-Server-BYOS-Azure:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-EC2-HVM:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 Image SLES15-SP2-Manager-4-1-Server-BYOS-GCE:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 SUSE Manager Server Module 4.1:cobbler-3.0.0+git20190806.32c4bae0-8.22.6.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213151-1/ https://www.suse.com/security/cve/CVE-2021-40325.html CVE-2021-40325