CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2021-45082
High (7.8). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in cobbler 3.3.1.
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWE
- CWE-77
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cobbler_project:cobbler
- fedoraproject:fedora
- opensuse:backports
- opensuse:factory
- suse:linux_enterprise_server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6cm4-gm85-972c | PyPI | cobbler | <3.3.1 | 3.3.1 |
| PYSEC-2022-37 | PyPI | cobbler | <3.3.1 | 3.3.1 |
References
- https://bugzilla.suse.com/show_bug.cgi?id=1193678
- https://github.com/cobbler/cobbler/releases
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEJN7CPW6YCHBFQPFZKGA6AVA6T5NPIW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE/