~ / search / GHSA-cpqf-3c3r-c9g2

GHSA-cpqf-3c3r-c9g2

Cobbler before 3.3.0 allows log poisoning

Source: GitHub Advisory Database (reviewed) High CVE-2021-40323

Packages

EcosystemPackageAffectedFixed in
PyPI cobbler < 3.3.0 3.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

References

External links from the advisory. They lead to third-party sites.