Live › vulnerability › CVE-2017-1000469
Go to dashboardCobbler up to 2.8.2 passes input from its "add repo" component into a shell command without sanitizing it. An attacker who can reach that function can run arbitrary commands as root on the Cobbler server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:20 UTC, 0h before NVD. All times on this page are UTC.
Teams running Cobbler 2.8.2 or earlier as a provisioning server, where the add-repo function is reachable by a user who can send it input. Whether a remote attacker can reach it depends on how the web and XML-RPC interfaces are exposed, which the sources do not say. Installations already on 3.0.0 or later are not affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| cobbler | pypi | <= 2.8.2 | 3.0.0 |
| cobbler project cobbler | vendor | <= 2.8.2 | – |
pip show cobbler or cobbler version to read the installed version2.8.23.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
This page as .md · .json · in your agent: get_signal("CVE-2017-1000469")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.