PYSEC-2021-373

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/cobbler/PYSEC-2021-373.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2021-373

Aliases

Published

2021-10-04T06:15:00Z

Modified

2023-11-01T04:56:19.280275Z

Summary

[none]

Details

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.

References

Affected packages

PyPI / cobbler

Package

Name: cobbler; View open source insights on deps.dev
Purl: pkg:pypi/cobbler

Affected ranges

Type: GIT
Repo: https://github.com/cobbler/cobbler
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

d8f60bbf14a838c8c8a1dba98086b223e35fe70a

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3.0

Affected versions

0.*

0.6.3-2

3.*

3.1.2

3.2.1

3.2.2