<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for cobbler</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2018:2590-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-09-03T07:34:02Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-09-03T07:34:02Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-09-03T07:34:02Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for cobbler</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for cobbler fixes the following issues:

Security issues fixed:

- Forbid exposure of private methods in the API (CVE-2018-10931,
  CVE-2018-1000225, bsc#1104287, bsc#1104189, bsc#1105442)
- Check access token when calling 'modify_setting' API endpoint (bsc#1104190,
  bsc#1105440, CVE-2018-1000226)

Other bugs fixed:

- Do not try to hardlink to a symlink. The result will be a dangling symlink
  in the general case. (bsc#1097733)
- fix kernel options when generating bootiso (bsc#1101670)
  
This update was imported from the SUSE:SLE-12:Update update project.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/opensuse-security-announce/2018-09/msg00001.html</URL>
      <Description>E-Mail link for openSUSE-SU-2018:2590-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="openSUSE Leap 42.3">
      <Branch Type="Product Name" Name="openSUSE Leap 42.3">
        <FullProductName ProductID="openSUSE Leap 42.3">openSUSE Leap 42.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="cobbler-2.6.6-17.1">
      <FullProductName ProductID="cobbler-2.6.6-17.1">cobbler-2.6.6-17.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="cobbler-tests-2.6.6-17.1">
      <FullProductName ProductID="cobbler-tests-2.6.6-17.1">cobbler-tests-2.6.6-17.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="cobbler-web-2.6.6-17.1">
      <FullProductName ProductID="cobbler-web-2.6.6-17.1">cobbler-web-2.6.6-17.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="koan-2.6.6-17.1">
      <FullProductName ProductID="koan-2.6.6-17.1">koan-2.6.6-17.1</FullProductName>
    </Branch>
    <Relationship ProductReference="cobbler-2.6.6-17.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:cobbler-2.6.6-17.1">cobbler-2.6.6-17.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="cobbler-tests-2.6.6-17.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:cobbler-tests-2.6.6-17.1">cobbler-tests-2.6.6-17.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="cobbler-web-2.6.6-17.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:cobbler-web-2.6.6-17.1">cobbler-web-2.6.6-17.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="koan-2.6.6-17.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:koan-2.6.6-17.1">koan-2.6.6-17.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).</Note>
    </Notes>
    <CVE>CVE-2018-1000225</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:cobbler-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:cobbler-tests-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:cobbler-web-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:koan-2.6.6-17.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-09/msg00001.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-1000225.html</URL>
        <Description>CVE-2018-1000225</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104190</URL>
        <Description>SUSE Bug 1104190</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104287</URL>
        <Description>SUSE Bug 1104287</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105442</URL>
        <Description>SUSE Bug 1105442</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.</Note>
    </Notes>
    <CVE>CVE-2018-1000226</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:cobbler-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:cobbler-tests-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:cobbler-web-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:koan-2.6.6-17.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-09/msg00001.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-1000226.html</URL>
        <Description>CVE-2018-1000226</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104190</URL>
        <Description>SUSE Bug 1104190</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104287</URL>
        <Description>SUSE Bug 1104287</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105440</URL>
        <Description>SUSE Bug 1105440</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105442</URL>
        <Description>SUSE Bug 1105442</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1131852</URL>
        <Description>SUSE Bug 1131852</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.</Note>
    </Notes>
    <CVE>CVE-2018-10931</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:cobbler-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:cobbler-tests-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:cobbler-web-2.6.6-17.1</ProductID>
        <ProductID>openSUSE Leap 42.3:koan-2.6.6-17.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>critical</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>9.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-09/msg00001.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-10931.html</URL>
        <Description>CVE-2018-10931</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104189</URL>
        <Description>SUSE Bug 1104189</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104190</URL>
        <Description>SUSE Bug 1104190</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104287</URL>
        <Description>SUSE Bug 1104287</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105440</URL>
        <Description>SUSE Bug 1105440</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1105442</URL>
        <Description>SUSE Bug 1105442</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1130105</URL>
        <Description>SUSE Bug 1130105</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
