CVE

Id
44819  
CVE No.
CVE-2010-2235  
Status
Candidate  
Description
template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.  
Phase
Assigned (20100609)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
489623 44819 CVE-2010-2235 CONFIRM:http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz  View
489624 44819 CVE-2010-2235 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=607662  View
489625 44819 CVE-2010-2235 REDHAT:RHSA-2010:0775  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
36157 JVNDB-2010-001937 libvirt における任意のファイルを読まれる脆弱性 libvirt には、ユーザーが定義するバッキングストアのフォーマットを設定せずに新しいイメージを作成してしまう不備があるため、ホスト OS 上の任意のファイルを読まれる脆弱性が存在します。 CVE-2010-2239 44819 4.4 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-001937.html  View