p PatchFirst

CVE-2014-3225

CVE-2014-3225

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Absolute path traversal vulnerability in the web interface in Cobbler 2.4.x through 2.6.x allows remote authenticated users to read arbitrary files via the Kickstart field in a profile.

EPSS 8.9% · Public exploit · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • cobbler PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 2.6.0, < 2.6.4

    Update to 2.6.4

  • cobbler PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0, < 2.4.7

    Update to 2.4.7

  • cobbler PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0, < 2.4.7 ∪ ≥ 2.6.0, < 2.6.4

    Update to 2.4.7; Update to 2.6.4

  • cobbler Ubuntu:Pro:16.04:LTS

    Versions
    • 2.4.1-0ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.4.1-0ubuntu2+esm1

    Update to 2.4.1-0ubuntu2+esm1

Original sources

Check your server →