<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for cobbler</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:2561-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-08-30T14:10:22Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-08-30T14:10:22Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-08-30T14:10:22Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for cobbler</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for cobbler fixes the following issues:

Security issues fixed:

- Forbid exposure of private methods in the API (CVE-2018-10931,
  CVE-2018-1000225, bsc#1104287, bsc#1104189, bsc#1105442)
- Check access token when calling 'modify_setting' API endpoint (bsc#1104190,
  bsc#1105440, CVE-2018-1000226)

Other bugs fixed:

- Do not try to hardlink to a symlink. The result will be a dangling symlink
  in the general case. (bsc#1097733)
- fix kernel options when generating bootiso (bsc#1101670)
  </Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">HPE-Helion-OpenStack-8-2018-1795,SUSE-OpenStack-Cloud-8-2018-1795,SUSE-SLE-Manager-Tools-12-2018-1795,SUSE-SUSE-Manager-Server-3.0-2018-1795</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182561-1/</URL>
      <Description>Link for SUSE-SU-2018:2561-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-August/004514.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:2561-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1097733</URL>
      <Description>SUSE Bug 1097733</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1101670</URL>
      <Description>SUSE Bug 1101670</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1104189</URL>
      <Description>SUSE Bug 1104189</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1104190</URL>
      <Description>SUSE Bug 1104190</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1104287</URL>
      <Description>SUSE Bug 1104287</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1105440</URL>
      <Description>SUSE Bug 1105440</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1105442</URL>
      <Description>SUSE Bug 1105442</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-1000225/</URL>
      <Description>SUSE CVE CVE-2018-1000225 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-1000226/</URL>
      <Description>SUSE CVE CVE-2018-1000226 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-10931/</URL>
      <Description>SUSE CVE CVE-2018-10931 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="HPE Helion OpenStack 8">
      <Branch Type="Product Name" Name="HPE Helion OpenStack 8">
        <FullProductName ProductID="HPE Helion OpenStack 8" CPE="cpe:/o:suse:hpe-helion-openstack:8">HPE Helion OpenStack 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Manager Server 3.0">
      <Branch Type="Product Name" Name="SUSE Manager Server 3.0">
        <FullProductName ProductID="SUSE Manager Server 3.0" CPE="cpe:/o:suse:suse-manager-server:3.0">SUSE Manager Server 3.0</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Manager Tools 12">
      <Branch Type="Product Name" Name="SUSE Manager Tools 12">
        <FullProductName ProductID="SUSE Manager Tools 12" CPE="cpe:/o:suse:sle-manager-tools:12">SUSE Manager Tools 12</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 8">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 8">
        <FullProductName ProductID="SUSE OpenStack Cloud 8" CPE="cpe:/o:suse:suse-openstack-cloud:8">SUSE OpenStack Cloud 8</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="cobbler-2.6.6-49.14.1">
      <FullProductName ProductID="cobbler-2.6.6-49.14.1">cobbler-2.6.6-49.14.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="koan-2.6.6-49.14.1">
      <FullProductName ProductID="koan-2.6.6-49.14.1">koan-2.6.6-49.14.1</FullProductName>
    </Branch>
    <Relationship ProductReference="cobbler-2.6.6-49.14.1" RelationType="Default Component Of" RelatesToProductReference="HPE Helion OpenStack 8">
      <FullProductName ProductID="HPE Helion OpenStack 8:cobbler-2.6.6-49.14.1">cobbler-2.6.6-49.14.1 as a component of HPE Helion OpenStack 8</FullProductName>
    </Relationship>
    <Relationship ProductReference="cobbler-2.6.6-49.14.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Manager Server 3.0">
      <FullProductName ProductID="SUSE Manager Server 3.0:cobbler-2.6.6-49.14.1">cobbler-2.6.6-49.14.1 as a component of SUSE Manager Server 3.0</FullProductName>
    </Relationship>
    <Relationship ProductReference="koan-2.6.6-49.14.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Manager Tools 12">
      <FullProductName ProductID="SUSE Manager Tools 12:koan-2.6.6-49.14.1">koan-2.6.6-49.14.1 as a component of SUSE Manager Tools 12</FullProductName>
    </Relationship>
    <Relationship ProductReference="cobbler-2.6.6-49.14.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 8">
      <FullProductName ProductID="SUSE OpenStack Cloud 8:cobbler-2.6.6-49.14.1">cobbler-2.6.6-49.14.1 as a component of SUSE OpenStack Cloud 8</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).</Note>
    </Notes>
    <CVE>CVE-2018-1000225</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:cobbler-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE Manager Server 3.0:cobbler-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE Manager Tools 12:koan-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:cobbler-2.6.6-49.14.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182561-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-1000225.html</URL>
        <Description>CVE-2018-1000225</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104190</URL>
        <Description>SUSE Bug 1104190</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104287</URL>
        <Description>SUSE Bug 1104287</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105442</URL>
        <Description>SUSE Bug 1105442</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.</Note>
    </Notes>
    <CVE>CVE-2018-1000226</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:cobbler-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE Manager Server 3.0:cobbler-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE Manager Tools 12:koan-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:cobbler-2.6.6-49.14.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182561-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-1000226.html</URL>
        <Description>CVE-2018-1000226</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104190</URL>
        <Description>SUSE Bug 1104190</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104287</URL>
        <Description>SUSE Bug 1104287</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105440</URL>
        <Description>SUSE Bug 1105440</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105442</URL>
        <Description>SUSE Bug 1105442</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1131852</URL>
        <Description>SUSE Bug 1131852</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.</Note>
    </Notes>
    <CVE>CVE-2018-10931</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>HPE Helion OpenStack 8:cobbler-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE Manager Server 3.0:cobbler-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE Manager Tools 12:koan-2.6.6-49.14.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 8:cobbler-2.6.6-49.14.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20182561-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-10931.html</URL>
        <Description>CVE-2018-10931</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104189</URL>
        <Description>SUSE Bug 1104189</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104190</URL>
        <Description>SUSE Bug 1104190</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104287</URL>
        <Description>SUSE Bug 1104287</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105440</URL>
        <Description>SUSE Bug 1105440</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105442</URL>
        <Description>SUSE Bug 1105442</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1130105</URL>
        <Description>SUSE Bug 1130105</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
