CVE-2011-4953 Cobbler vulnerable to code injection via unsafe YAML loading
MediumCVSS 6.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi cobbler(PyPI) | < 2.6.0 | 2.6.0 |
| pypi cobbler(PyPI) | = 0.6.3-2 | No fix listed |
| cobbler project cobbler | <= 2.2.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.launchpad.net
- bugzilla.novell.com
- github.com product
- SUSE-SU-2012:0552 vendor-advisory
- pypi.org product
- github.com vendor-advisory