High severityNVD Advisory· Published Aug 12, 2009· Updated Apr 23, 2026
CVE-2008-6954
CVE-2008-6954
Description
The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote authenticated users to execute arbitrary Python code in cobblerd by editing a Cheetah kickstart template to import arbitrary Python modules.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
cobblerPyPI | < 1.2.9 | 1.2.9 |
Affected products
42cpe:2.3:a:michael_dehaan:cobbler:*:*:*:*:*:*:*:*+ 41 more
- cpe:2.3:a:michael_dehaan:cobbler:*:*:*:*:*:*:*:*range: <=1.2.8
- cpe:2.3:a:michael_dehaan:cobbler:0.1.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:0.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.0.2-1:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.0.3-1:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:michael_dehaan:cobbler:1.2.7:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
13- freshmeat.net/projects/cobbler/releases/288374nvdPatchWEB
- www.securityfocus.com/bid/32317nvdPatch
- secunia.com/advisories/32737nvdVendor Advisory
- secunia.com/advisories/32804nvdVendor Advisory
- github.com/advisories/GHSA-p8w2-f44p-fmcjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2008-6954ghsaADVISORY
- exchange.xforce.ibmcloud.com/vulnerabilities/46625nvdWEB
- web.archive.org/web/20111227125913/http://secunia.com/advisories/32804ghsaWEB
- web.archive.org/web/20111227151912/http://secunia.com/advisories/32737ghsaWEB
- web.archive.org/web/20200228143518/http://www.securityfocus.com/bid/32317ghsaWEB
- www.redhat.com/archives/fedora-package-announce/2008-November/msg00462.htmlnvdWEB
- www.redhat.com/archives/fedora-package-announce/2008-November/msg00485.htmlnvdWEB
- osvdb.org/50291nvd
News mentions
0No linked articles in our index yet.