Cobbler vulnerable to code injection via unsafe YAML loading

published 2014-10-27 12 y ago modified 2026-07-07 4 mo ago also GHSA-hpj3-5p46-g87w , PYSEC-2026-793 , EUVD-2022-4186

cvss: 6.8; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.2%; EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits: 0; none known

The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.

Patch / fix

fixed in 1 distros 1 links 1

pypi cobbler 2.6.0

cobbler openSUSE Tumbleweed 3.2.1.336+git.5639a3af-1.1
koan openSUSE Tumbleweed 3.0.1-1.2
cobbler Package Hub 15 SP2 3.1.2-bp152.4.3.1
cobbler openSUSE Leap 15.2 3.1.2-lp152.6.3.1

opensuse advisories openSUSE-SU-2024:10690-1 openSUSE-SU-2024:10897-1 openSUSE-SU-2021:0058-1 openSUSE-SU-2021:0046-1

github.com/cobbler/cobbler@1b4f9ec commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-4953 updated 2026-01-28 cvss 7.1

cobbler: Privilege escalation by processing of crafted management parameters

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
pypi	cobbler	<2.6.0	2.6.0

Classification

Weakness

CWE-20 Improper Input Validation
CWE-94 Improper Control of Generation of Code

References

github.com /cobbler/cobbler/commit/1b4f9ecf051422eb8512794701900f6199651442
web
lists.opensuse.org /opensuse-security-announce/2012-04/msg00019.html
vendor-advisory, web
bugs.launchpad.net /ubuntu/oneiric/+source/cobbler/+bug/858883
web
bugzilla.novell.com /show_bug.cgi?id=757062
web
nvd.nist.gov /vuln/detail/CVE-2011-4953
advisory
github.com /cobbler/cobbler
package
pypi.org /project/cobbler
package
github.com /advisories/GHSA-hpj3-5p46-g87w
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary