PatchTheCVEcobbler vulnerabilities and fixes
Recent CVEs affecting cobbler, with upgrade or downgrade steps. 7 tracked.
cobbler has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 7. Most recent: 2022-03-11. Highest priority: CVE-2021-40323 (score 64/100).
- CVE-2022-0860 CRITICAL 9.1 UPGRADE MITIGATE Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
- CVE-2021-45083 HIGH 7.1 UPGRADE MITIGATE An issue was discovered in Cobbler before 3.3.1
- CVE-2021-45082 HIGH 7.8 UPGRADE MITIGATE An issue was discovered in Cobbler before 3.3.1
- CVE-2021-45081 MEDIUM 5.9 UPGRADE An issue was discovered in Cobbler through 3.3.1
- CVE-2021-40325 HIGH 7.5 UPGRADE Cobbler before 3.3.0 allows authorization bypass for modification of settings.
- CVE-2021-40324 HIGH 7.5 UPGRADE Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
- CVE-2021-40323 CRITICAL 9.8 UPGRADE Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs
FAQ
How do I fix cobbler vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is cobbler being exploited right now?
None of the tracked cobbler CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which cobbler CVE should I patch first?
CVE-2021-40323 currently ranks highest (64/100): Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs.