-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe pre-patch code in action_power.py's power method used Cheetah templating to build commands from user-controlled inputs (power_user/power_pass) and executed them through a shell interpreter. The critical vulnerability stemmed from: 1) Direct interpolation of untrusted inputs into command strings 2) Use of '/bin/sh -c' which processes shell metacharacters 3) Lack of input sanitization. The patch (6d9167e) explicitly fixes this by switching to stdin-based command execution with fence agents, eliminating shell command interpolation. The subprocess_sp changes in utils.py support this fix but weren't the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| cobbler | pip | < 2.6.0 | 2.6.0 |