Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / cobbler/PYSEC-2026-793
Advisory ID pypa/cobbler/PYSEC-2026-793
Aliases CVE-2011-4953
GHSA-hpj3-5p46-g87w
PYSEC-2026-793
Summary Cobbler vulnerable to code injection via unsafe YAML loading The `set_mgmt_parameters` function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the `yaml.load` function instead of the `yaml.safe_load function`, as demonstrated using Puppet.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00019.html
https://bugs.launchpad.net/ubuntu/oneiric/+source/cobbler/+bug/858883
https://bugzilla.novell.com/show_bug.cgi?id=757062
https://github.com/cobbler/cobbler
https://github.com/cobbler/cobbler/commit/1b4f9ecf051422eb8512794701900f6199651442
https://pypi.org/project/cobbler
CVE-2011-4953 https://nvd.nist.gov/vuln/detail/CVE-2011-4953
GHSA-hpj3-5p46-g87w https://github.com/advisories/GHSA-hpj3-5p46-g87w
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.