Security update for cobbler SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:0509-1 Final 1 1 2022-02-18T10:45:09Z current 2022-02-18T10:45:09Z 2022-02-18T10:45:09Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cobbler This update for cobbler fixes the following issues: - CVE-2021-45083: Fixed unsafe permissions on sensitive files (bsc#1193671). - CVE-2021-45082: Fixed incomplete template sanitation (bsc#1193678). The following non-security bugs were fixed: - Fix issues with installation module logging and validation (bsc#1195918) - Move configuration files ownership to apache (bsc#1195906) - Remove hardcoded test credentials (bsc#1193673) - Prevent log pollution (bsc#1193675) - Missing sanity check on MongoDB configuration file (bsc#1193676) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2022-509,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2022-509,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2022-509,SUSE-2022-509,SUSE-SLE-Module-SUSE-Manager-Server-4.2-2022-509 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20220509-1/ Link for SUSE-SU-2022:0509-1 https://lists.suse.com/pipermail/sle-security-updates/2022-February/010259.html E-Mail link for SUSE-SU-2022:0509-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1193671 SUSE Bug 1193671 https://bugzilla.suse.com/1193673 SUSE Bug 1193673 https://bugzilla.suse.com/1193675 SUSE Bug 1193675 https://bugzilla.suse.com/1193676 SUSE Bug 1193676 https://bugzilla.suse.com/1193678 SUSE Bug 1193678 https://bugzilla.suse.com/1195906 SUSE Bug 1195906 https://bugzilla.suse.com/1195918 SUSE Bug 1195918 https://www.suse.com/security/cve/CVE-2021-45082/ SUSE CVE CVE-2021-45082 page https://www.suse.com/security/cve/CVE-2021-45083/ SUSE CVE CVE-2021-45083 page Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE SUSE Manager Server Module 4.2 cobbler-3.1.2-150300.5.14.1 cobbler-tests-3.1.2-150300.5.14.1 cobbler-web-3.1.2-150300.5.14.1 cobbler-3.1.2-150300.5.14.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure cobbler-3.1.2-150300.5.14.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM cobbler-3.1.2-150300.5.14.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE cobbler-3.1.2-150300.5.14.1 as a component of SUSE Manager Server Module 4.2 An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.) CVE-2021-45082 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:cobbler-3.1.2-150300.5.14.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:cobbler-3.1.2-150300.5.14.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:cobbler-3.1.2-150300.5.14.1 SUSE Manager Server Module 4.2:cobbler-3.1.2-150300.5.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220509-1/ https://www.suse.com/security/cve/CVE-2021-45082.html CVE-2021-45082 https://bugzilla.suse.com/1193678 SUSE Bug 1193678 An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password. CVE-2021-45083 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:cobbler-3.1.2-150300.5.14.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:cobbler-3.1.2-150300.5.14.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:cobbler-3.1.2-150300.5.14.1 SUSE Manager Server Module 4.2:cobbler-3.1.2-150300.5.14.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20220509-1/ https://www.suse.com/security/cve/CVE-2021-45083.html CVE-2021-45083 https://bugzilla.suse.com/1193671 SUSE Bug 1193671