SUSE-SU-2021:3151-1: critical: Security update for cobbler

sle-security-updates at sle-security-updates at
Mon Sep 20 19:32:22 UTC 2021

   SUSE Security Update: Security update for cobbler

Announcement ID:    SUSE-SU-2021:3151-1
Rating:             critical
References:         #1189458 
Cross-References:   CVE-2021-40323 CVE-2021-40324 CVE-2021-40325
Affected Products:
                    SUSE Linux Enterprise Module for SUSE Manager Server 4.1

   An update that fixes three vulnerabilities is now available.


   This update for cobbler fixes the following issues:

   Security issues fixed:

   - CVE-2021-40323: Fixed an arbitrary file disclosure/Template Injection
   - CVE-2021-40324: Fixed an arbitrary file write (bsc#1189458)
   - CVE-2021-40325: Fixed a problem with the token validation (bsc#1189458)

   - Please note that with these changes, a valid log data from Anamon (Red
     Hat Autoinstallation Process) uploaded to cobbler may be rejected

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.1:

      zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Server-4.1-2021-3151=1

Package List:

   - SUSE Linux Enterprise Module for SUSE Manager Server 4.1 (noarch):



More information about the sle-security-updates mailing list