CRITICAL9.8
PYSEC-2026-313
Cobbler has Exposed Dangerous Method or Function
Quick fix
PYSEC-2026-313 — cobbler: upgrade to the fixed version with the command below.
pip install --upgrade 'cobbler>=3.0.0'Details
It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-10931[ADVISORY]
- https://github.com/cobbler/cobbler/issues/1916[WEB]
- https://github.com/cobbler/cobbler/pull/1921[WEB]
- https://github.com/cobbler/cobbler/commit/1b91a3d3ac87c31d9dac2307513feb2aa49620a6[WEB]
- https://access.redhat.com/errata/RHSA-2018:2372[WEB]
- https://access.redhat.com/security/cve/CVE-2018-10931[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=1613861[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10931[WEB]
- https://github.com/cobbler/cobbler[PACKAGE]
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5P5Q4ACIVZ5D4KSUDLGRTOKGGB4U42SD[WEB]
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMWK5KCCZXOGOYNR2H6BWDSABTQ5NYJA[WEB]
- https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api[WEB]
- https://pypi.org/project/cobbler[PACKAGE]
- https://github.com/advisories/GHSA-8787-63px-3m23[ADVISORY]