CVE-2008-6954: Code Injection
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Other sources
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code with the root privileges in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
— GitHub
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-6954?
CVE-2008-6954 has a medium severity rating due to its ability to execute arbitrary Python code by remote authenticated users.
How do I fix CVE-2008-6954?
To fix CVE-2008-6954, upgrade Cobbler to version 1.2.9 or later.
What versions are affected by CVE-2008-6954?
CVE-2008-6954 affects Cobbler versions prior to 1.2.9, including 1.0.2, 1.2.0, 1.2.6, and other earlier releases.
Who is affected by CVE-2008-6954?
Users of Cobbler versions prior to 1.2.9 who have remote authenticated access are affected by CVE-2008-6954.
What is the exploit method for CVE-2008-6954?
CVE-2008-6954 can be exploited by editing a Cheetah kickstart template in the CobblerWeb interface to import arbitrary Python modules.