CVE-2021-45082

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

Published: Feb 19, 2022
Updated: Nov 8, 2023
CVE: CVE-2021-45082
GHSA: GHSA-6cm4-gm85-972c
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.8
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Low
Score: 4.6
AV:L/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-77

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
cobbler_project / cobbler	-	3.3.1
suse / linux_enterprise_server	11-sp3	11-sp3.x
suse / linux_enterprise_server	12	12.x
suse / linux_enterprise_server	15-sp2	15-sp2.x
opensuse / backports	sle-15-sp4	sle-15-sp4.x
opensuse / backports	sle-15-sp3	sle-15-sp3.x
suse / linux_enterprise_server	15-sp3	15-sp3.x
fedoraproject / fedora	34	34.x
fedoraproject / fedora	35	35.x
fedoraproject / fedora	36	36.x
cobbler	-	3.3.1

Vulnerability Database

300,445

CVE-2021-45082

Deep Security Visibility Without the Complexity