CVE-2021-40323: Cobbler Log Poisoning and Remote Code Execution
Summary
CVE-2021-40323: Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection. Affects cobbler across 2 version ranges.
< 3.3.0
< d8f60bbf14a838c8c8a1dba98086b223e35fe70a
Fixed in d8f60bbf14a838c8c8a1dba98086b223e35fe70a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cobbler is a package available on PyPI that provides a network boot and installation server. It is commonly used for managing Linux installation servers and automating the installation of operating systems. Cobbler allows administrators to configure and manage various aspects of the installation process, such as network settings, partitioning, and package selection. However, a vulnerability in Cobbler versions prior to 3.3.0 allows log poisoning, which can lead to remote code execution. This vulnerability can be exploited through an XMLRPC method that logs to the logfile, enabling template injection.
Vulnerability Detail
The vulnerability in Cobbler arises from the lack of proper input validation and sanitization when handling log entries. An attacker can craft malicious XMLRPC requests that inject template code into the logfile. When the log file is processed, the injected code gets executed, leading to remote code execution on the server running Cobbler. This can result in unauthorized access, data leakage, or even complete compromise of the affected system. The vulnerability was addressed in version 3.3.0 of Cobbler.
How To Fix
Latest published version: 3.3.10 as of 23 Oct 2026
pip install --upgrade "cobbler==3.3.10"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
d8f60bbf14a838c8c8a1dba98086b223e35fe70a
This is the first release that contains the fix.
pip install --upgrade "cobbler==d8f60bbf14a838c8c8a1dba98086b223e35fe70a"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the XMLRPC functionality in Cobbler. This can be achieved by modifying the Cobbler configuration file and commenting out or removing the XMLRPC-related configuration options. However, this workaround should only be considered as a temporary measure, and upgrading to the latest version is strongly recommended.
Conclusion
The vulnerability in Cobbler versions prior to 3.3.0 allows log poisoning, which can lead to remote code execution. It is crucial to upgrade to the latest version of Cobbler (3.3.0 or later) to mitigate this vulnerability. If immediate upgrading is not possible, disabling the XMLRPC functionality can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cobbler →
FAQ
Cobbler is a package available on PyPI that provides a network boot and installation server. It is commonly used for managing Linux installation servers and automating the installation of operating systems.
The vulnerability allows log poisoning, which can lead to remote code execution. An attacker can inject malicious code into the logfile, which gets executed when the log file is processed. This can result in unauthorized access, data leakage, or complete compromise of the affected system.
To fix this vulnerability, it is recommended to upgrade Cobbler to version 3.3.0 or later. This can be done by updating the package using the package manager or by manually installing the latest version from the PyPI repository. After upgrading, ensure that the Cobbler service is restarted.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the XMLRPC functionality in Cobbler. This can be achieved by modifying the Cobbler configuration file and commenting out or removing the XMLRPC-related configuration options.
For more information about this vulnerability, you can refer to the official advisory provided by the Python Package Authority (PyPA) advisory database. The advisory can be found at the following source: https://github.com/pypa/advisory-database/blob/main/vulns/cobbler/PYSEC-2021-373.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for cobbler.
