CVE-2021-45081

Published: 20 February 2022

An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.

Notes

Using HTTPS everywhere requires a deep knowledge of how customers
implements cobbler in their network and how do they manage certificates.
The maintainer decided to not patch this vulnerability, and will keep attention
on this in order to create a certificate enrolling and trusting layer in the
python code for the future. Thus, this CVE is marked as ignored.

Status

Severity score breakdown

References

• https://github.com/cobbler/cobbler/releases
• http://www.openwall.com/lists/oss-security/2022/02/18/3
• https://www.cve.org/CVERecord?id=CVE-2021-45081
• NVD
• Launchpad
• Debian