CVE-2011-4953: Input Validation
The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet.
Other sources
The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4953?
CVE-2011-4953 is a critical vulnerability that allows context-dependent attackers to execute arbitrary code.
How do I fix CVE-2011-4953?
To fix CVE-2011-4953, upgrade Cobber to version 2.6.0 or later, or ensure that version 2.2.2 or newer is in use.
Which versions of Cobbler are affected by CVE-2011-4953?
CVE-2011-4953 affects Cobbler versions prior to 2.2.2, including 2.2.1 and below.
What function is the root cause of CVE-2011-4953?
The vulnerability in CVE-2011-4953 is caused by the use of the `yaml.load` function instead of `yaml.safe_load` in the `set_mgmt_parameters` function.
Is CVE-2011-4953 related to any specific attack vectors?
CVE-2011-4953 can be exploited through context-dependent vectors, as demonstrated in attacks using Puppet.