template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products,
    does not disable the ability of the Cheetah template engine to execute Python statements contained in
    templates, which allows remote authenticated administrators to execute arbitrary code via a crafted
    kickstart template file, a different vulnerability than CVE-2008-6954. (CVE-2010-2235)

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2010:0775 advisory.

    Cobbler is a network install server. Cobbler supports PXE, virtualized     installs, and re-installing existing Linux machines. Cheetah is a template     engine used by Cobbler to process kickstart files.

    A code injection flaw was found in the way Cobbler processed templates for     kickstart files. A remote, authenticated user, that has the Configuration     Administrator role privilege, could use this flaw to create a     specially-crafted kickstart template file containing embedded Python code     that could, when processed by Cheetah, execute arbitrary code with root     privileges on the Red Hat Network Satellite Server. (CVE-2010-2235)

    Red Hat would like to thank Doug Knight of the University of Alaska for     reporting this issue.

    Users of Red Hat Network Satellite Server 5.3 are advised to upgrade to     this updated cobbler package, which contains backported patches to correct     this issue. Red Hat Network Satellite Server must be restarted     (/usr/sbin/rhn-satellite restart) for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
416392	SCA: security update for cobbler (GHSA-jhm7-38xj-pvm8)	Tenable Cloud Security	SCA Checks	critical
416392	SCA: security update for cobbler (GHSA-jhm7-38xj-pvm8)	Tenable Self-Hosted Container Security	SCA Checks	critical
50009	RHEL 5 : cobbler (RHSA-2010:0775)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2010-2235

critical

Tenable Plugins

critical

critical

critical