Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Red Hat Satellite 5.6-5.8 RHSA-2018:2372-01 Critical: Cobbler Security Fix

red hat
Calendar Grey August 9, 2018
Scroller Redhat
A vital security patch has been released for Cobbler in the Red Hat Satellite environment. It is essential to implement this update to protect your systems.
An update for cobbler is now available for Red Hat Satellite 5.6, Red Hat Satellite 5.7, and Red Hat Satellite 5.8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

For this update to take effect, Red Hat Satellite must be restarted ("/usr/sbin/rhn-satellite restart").

Summary

Cobbler is a network install server. Cobbler supports PXE, virtualized installs, and re-installing existing Linux machines. Cobbler has a XMLRPC API for integration with other applications.
Security Fix(es):
* cobbler: CobblerXMLRPCInterface exports all its methods over XMLRPC (CVE-2018-10931)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
This issue was discovered by Cedric Buissart (Red Hat).

Topics%20covered

Topics Covered

security advisory critical security fix cobbler Red Hat Satellite network install server CobblerXMLRPCInterface

References

https://access.redhat.com/security/cve/CVE-2018-10931 https://access.redhat.com/security/updates/classification#critical

Package List

Red Hat Satellite 5.6 (RHEL v.6):
Source: cobbler-2.0.7-44.1.el6sat.src.rpm
noarch: cobbler-2.0.7-44.1.el6sat.noarch.rpm
Red Hat Satellite 5.7 (RHEL v.6):
Source: cobbler-2.0.7-68.1.el6sat.src.rpm
noarch: cobbler-2.0.7-68.1.el6sat.noarch.rpm
Red Hat Satellite 5.8 (RHEL v.6):
Source: cobbler-2.0.7-73.el6sat.src.rpm
noarch: cobbler-2.0.7-73.el6sat.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:2372-01
Product: Red Hat Satellite
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2372
Issue date: 2018-08-09

Topic

An update for cobbler is now available for Red Hat Satellite 5.6, Red HatSatellite 5.7, and Red Hat Satellite 5.8.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory critical security fix cobbler Red Hat Satellite network install server CobblerXMLRPCInterface

Relevant Releases Architectures

Red Hat Satellite 5.6 (RHEL v.6) - noarch

Red Hat Satellite 5.7 (RHEL v.6) - noarch

Red Hat Satellite 5.8 (RHEL v.6) - noarch

Bugs Fixed

1613861 - CVE-2018-10931 cobbler: CobblerXMLRPCInterface exports all its methods over XMLRPC

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.