CVE-2011-4953
cobbler < 2.2.2 - Remote Code Execution via YAML Deserialization
Title source: llmDescription
The set_mgmt_parameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safe_load function, as demonstrated using Puppet.
References (3)
Core 3
Core References
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00019.html
Issue Tracking x_refsource_confirm
https://bugs.launchpad.net/ubuntu/oneiric/+source/cobbler/+bug/858883
Issue Tracking x_refsource_confirm
https://bugzilla.novell.com/show_bug.cgi?id=757062
Scores
EPSS
0.0217
EPSS Percentile
80.2%
Details
CWE
CWE-20
Status
published
Products (2)
cobbler_project/cobbler
< 2.2.1
pypi/cobbler
0 - 2.6.0PyPI
Published
Oct 27, 2014
Tracked Since
Feb 18, 2026