CVE-2021-45083

Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 3.3.1

Description An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest of users, which can be used to obtain plaintext strings for easy-to-guess passwords. The settings.yaml file contains secrets such as the hashed default password.

Recommendations For versions prior to 3.3.1, update to version 3.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /etc/cobbler directory to minimize the risk of exploitation.