Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / cobbler/PYSEC-2026-794
Advisory ID pypa/cobbler/PYSEC-2026-794
Aliases CVE-2010-2235
GHSA-jhm7-38xj-pvm8
PYSEC-2026-794
Summary Cobbler is vulnerable to code injection template_api.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a crafted kickstart template file, a different vulnerability than CVE-2008-6954.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://bugzilla.redhat.com/show_bug.cgi?id=607662
https://github.com/cobbler/cobbler
https://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz
https://pypi.org/project/cobbler
https://www.redhat.com/support/errata/RHSA-2010-0775.html
CVE-2010-2235 https://access.redhat.com/security/cve/CVE-2010-2235
CVE-2010-2235 https://nvd.nist.gov/vuln/detail/CVE-2010-2235
GHSA-jhm7-38xj-pvm8 https://github.com/advisories/GHSA-jhm7-38xj-pvm8
RHSA-2010:0775 https://access.redhat.com/errata/RHSA-2010:0775
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
There are no known vectors.

There are no SSVC decisions available.