PT-2022-12304 · Cobbler+2 · Cobbler+2

Paolo Perego + 1 · Published 2022-01-12 · Updated 2025-05-16 · CVE-2021-45083

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 3.3.1

Description An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest of users, which can be used to obtain plaintext strings for easy-to-guess passwords. The settings.yaml file contains secrets such as the hashed default password.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /etc/cobbler directory to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2021-45083

GHSA-5946-MPW5-PQXX

OESA-2025-1467

OESA-2025-1468

OESA-2025-1469

OESA-2025-1527

OPENSUSE-SU-2022_0062-1

PYSEC-2022-38

SUSE-FU-2022:0750-1

SUSE-SU-2022:0507-1

SUSE-SU-2022:0509-1

SUSE-SU-2022:0510-1

SUSE-SU-2022:14891-1

SUSE-SU-2022_14891-1

USN-6475-1

Affected Products

Cobbler

Suse

Ubuntu

References · 64

• https://nvd.nist.gov/vuln/detail/CVE-2021-45081 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1467 · Vendor Advisory
• https://openwall.com/lists/oss-security/2022/02/18/3 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z5CSXQE7Q4TVDQJKFYBO4XDH3BZ7BLAR · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-10931 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-45083 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-45083 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:0510-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-45083 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:0509-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZCXMOUW4DH4DYWIJN44SMSU6R3CZDZBE · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-1000469 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-40323 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3225 · Vendor Advisory