PYSEC-2026-792
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/cobbler/PYSEC-2026-792.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-792
- Aliases
-
- CVE-2012-2395
- GHSA-g34c-mg6m-xvxj
- Published
- 2026-07-06T08:03:27.199888Z
- Modified
- 2026-07-07T11:45:43.803835389Z
- Summary
- Cobbler subject to Command Injection
- Details
-
A Command Injection in actionpower.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the powersystem method in the xmlrpc API.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2012-2395
- https://github.com/cobbler/cobbler/issues/141
- https://github.com/cobbler/cobbler/commit/6d9167e5da44eca56bdf42b5776097a6779aaadf
- https://bugs.launchpad.net/ubuntu/+source/cobbler/+bug/978999
- https://github.com/cobbler/cobbler
- https://lists.opensuse.org/opensuse-security-announce/2012-05/msg00016.html
- https://lists.opensuse.org/opensuse-security-announce/2012-07/msg00000.html
- https://web.archive.org/web/20120712025653/http://www.securityfocus.com/bid/53666
- https://www.openwall.com/lists/oss-security/2012/05/23/18
- https://www.openwall.com/lists/oss-security/2012/05/23/4
- https://www.osvdb.org/82458
- https://pypi.org/project/cobbler
- https://github.com/advisories/GHSA-g34c-mg6m-xvxj
Affected packages
PyPI / cobbler
Package
- Name
- cobbler
- View open source insights on deps.dev
- Purl
- pkg:pypi/cobbler