CVE-2021-45081

一、漏洞信息
 漏洞编号：[CVE-2021-45081](https://nvd.nist.gov/vuln/detail/CVE-2021-45081)
 漏洞归属组件：[cobbler](https://gitee.com/src-openeuler/cobbler)
 漏洞归属的版本：3.2.0
 CVSS V3.0分值：
  BaseScore：5.9 Medium
  Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
 漏洞简述：
  An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.
 漏洞公开时间：2022-02-21 02:15
 漏洞创建时间：2022-02-28 22:40:03
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-45081
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| MISC | https://github.com/cobbler/cobbler/releases |  |
| MLIST | http://www.openwall.com/lists/oss-security/2022/02/18/3 |  |
| MISC | https://bugzilla.suse.com/show_bug.cgi?id=1193683 |  |
| redhat | https://access.redhat.com/security/cve/CVE-2021-45081 |  |
| suse_bugzilla | http://$http_server/cblr/links/$distro_name $os_version main |  |
| suse_bugzilla | http://$http_server/cblr/repo_mirror/${repo.name} $dist $comps |  |
| suse_bugzilla | http://$redhat_management_server/pub/RHN-ORG-TRUSTED-SSL-CERT -o $mycert |  |
| suse_bugzilla | http://$http_server/cobbler/links/$distro_name/install/filesystem.squashfs |  |
| suse_bugzilla | http://local.server/key |  |
| suse_bugzilla | http://$http_server/cblr/svc/op/script/$what/$name/?script=preseed_early_default | \ |  |
| suse_bugzilla | http://$http_server/cblr/svc/op/script/$what/$name/?script=preseed_late_default | \ |  |
| suse_bugzilla | http://www.debian.org/releases/stable/i386/apbs04.html.en & preseed documentation |  |
| suse_bugzilla | http://aspn.activestate.com/ASPN/Cookbook/Python/Recipe/66012 |  |
| suse_bugzilla | http://localhost:9001/RPC2') as server: |  |
| suse_bugzilla | http://, ftp://, or |  |
| suse_bugzilla | http:// and ftp:// yum repos. |  |
| suse_bugzilla | http:// and ftp:// debian repos. |  |
| suse_bugzilla | http:// URLs on the Cobbler server that point to yum configuration files that can be used to |  |
| suse_bugzilla | http:// trailing fragment) |  |
| suse_bugzilla | http://us.archive.ubuntu.com/ubuntu |  |
| suse_bugzilla | http://%s:%s/cobbler/links/%s' % (self.settings.server, self.settings.http_port, |  |
| suse_bugzilla | http://@@http_server@@/cobbler/images/@@distro_name@@/' |  |
| suse_bugzilla | http://%s/cblr/svc/op/nopxe/system/%s' % (cobbler_server_hostname, system_name) |  |
| suse_bugzilla | http://127.0.0.1:25151/ |  |
| suse_bugzilla | http://cobbler.example.org/cblr/repo_mirror and yum |  |
| suse_bugzilla | http://mirrors.kernel.org/fedora/releases/16/Fedora/x86_64/os/ |  |
| suse_bugzilla | http://mirrors.kernel.org/opensuse/distribution/11.4/repo/oss/ |  |
| suse_bugzilla | http://fedorahosted.org/func |  |
| suse_bugzilla | http://some.server.com/some-av-package.tar.gz |  |
| suse_bugzilla | http://some.server.com/fw-linux-installer.sh |  |
| suse_bugzilla | http://download.opensuse.org/repositories/Debian:/debbuild/Debian_10/Release.key | apt-key add - && \ |  |
| suse_bugzilla | http://download.opensuse.org/repositories/Debian:/debbuild/Debian_11/Release.key | apt-key add - && \ |  |
| suse_bugzilla | http://@@http_server@@/cblr/links/fedora17-x86_64'} |  |
| suse_bugzilla | http://cfengine.com/>`_, |  |
| suse_bugzilla | http://puppetlabs.com/>`_, `bcfg2 <http://bcfg2.org>`_, `Chef <http://wiki.opscode.com/display/chef/Home>`_, |  |
| suse_bugzilla | http://watzmann.net/blog/2006/12/kickstarting-into-puppet.html>`_. |  |
| suse_bugzilla | http://cfengine.com/>`_, `bcfg2 <http://bcfg2.org>`_, |  |
| suse_bugzilla | http://wiki.opscode.com/display/chef/Home>`_, or `puppet <http://puppetlabs.com/>`_. |  |
| suse_bugzilla | http://cheetahtemplate.org>`_ templating engine used in |  |
| suse_bugzilla | http://cobbler/cblr/svc/op/puppet/hostname/foo |  |
| suse_bugzilla | http://.../x86_64/tree' |  |
| suse_bugzilla | http://blog.milford.io/2012/03/getting-a-basic-cobbler-server-going-on-centos/) |  |
| suse_bugzilla | http://<server>/cblr/svc/op/autoinstall/<profile|system>/name``. |  |
| suse_bugzilla | http://@@http_server@@/cobbler/images/@@distro_name@@/wimboot \ |  |
| suse_bugzilla | http://@@http_server@@/cobbler/images/@@distro_name@@/boot.sdi \ |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/wimboot |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/boot.sdi boot.sdi |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/boot1ea.exe bootmgr.exe |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/1Ea bcd |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/winpe.wim winpe.wim |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/boot1eb.exe bootmgr.exe |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/1Eb bcd |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/winp1.wim winpe.wim |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/boot1ec.exe bootmgr.exe |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/1Ec bcd |  |
| suse_bugzilla | http://<http_server>/cobbler/images/Win10_EN-x64/winp2.wim winpe.wim |  |
| suse_bugzilla | http: http://192.168.1.1:8080 |  |
| suse_bugzilla | http://10.0.0.1:8080`` |  |
| suse_bugzilla | http://cobbler.example.org/cblr/repo_mirror`` and YUM configuration can |  |
| suse_bugzilla | http://`` | |  |
| suse_bugzilla | http://mirrors.kernel.org/fedora/extras/6/i386/`` (for http)                                  | |  |
| suse_bugzilla | http://`` and ``ftp://``| |  |
| suse_bugzilla | http://`` and ``ftp://`` repositories (as it is powered by           | |  |
| suse_bugzilla | http://`` or ``ftp://``. |  |
| suse_bugzilla | http://mirrors.kernel.org/fedora/core/updates/6/i386/ --name=fc6i386updates |  |
| suse_bugzilla | http://mirrors.kernel.org/fedora/extras/6/i386/ --name=fc6i386extras |  |
| suse_bugzilla | http://${server}/cblr/svc/op/autoinstall/system/testbed' |  |
| suse_bugzilla | http://$server:$http_port/cblr/svc/op/ks/$what/$name |  |
| suse_bugzilla | http://cr.yp.to/djbdns/tinydns-data.html for a description of the data |  |
| suse_bugzilla | http://$server/cblr/svc/op/ks/system/$name |  |
| suse_bugzilla | http://$server/cblr/svc/op/ks/profile/$name |  |
| suse_bugzilla | http://@@http_server@@/cblr/svc/op/autoinstall/profile/%1 -O install.cmd |  |
| suse_bugzilla | http://yaml.org |  |
| redhat_bugzilla | https://github.com/cobbler/cobbler/releases |  |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45081 |  |
| ubuntu | https://github.com/cobbler/cobbler/releases |  |
| ubuntu | http://www.openwall.com/lists/oss-security/2022/02/18/3 |  |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2021-45081 |  |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2021-45081 |  |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2021-45081 |  |
| debian | https://security-tracker.debian.org/tracker/CVE-2021-45081 |  |
| MISC | https://bugzilla.suse.com/show_bug.cgi?id=1193683 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

无
</details>

二、漏洞分析结构反馈
 影响性分析说明：
  An issue was discovered in Cobbler through 3.3.1. Routines in several files use the HTTP protocol instead of the more secure HTTPS.
 openEuler评分：
  5.9
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
 受影响版本排查(受影响/不受影响)：
  1.master(3.3.7):受影响
2.openEuler-20.03-LTS-SP4(3.2.0):受影响
3.openEuler-22.03-LTS-SP3(3.2.3):受影响
4.openEuler-22.03-LTS-SP4(3.2.3):受影响
5.openEuler-24.03-LTS(3.2.3):受影响
6.openEuler-24.03-LTS-Next(3.2.3):受影响
7.openEuler-24.03-LTS-SP1(3.2.3):受影响
8.openEuler-24.03-LTS-SP2(3.2.3):受影响

修复是否涉及abi变化(是/否)：
  1.master(3.3.7):是
2.openEuler-20.03-LTS-SP4(3.2.0):否
3.openEuler-22.03-LTS-SP3(3.2.3):否
4.openEuler-22.03-LTS-SP4(3.2.3):否
5.openEuler-24.03-LTS(3.2.3):否
6.openEuler-24.03-LTS-Next(3.2.3):否
7.openEuler-24.03-LTS-SP1(3.2.3):否
8.openEuler-24.03-LTS-SP2(3.2.3):否

原因说明：
  1.master(3.3.7):正常修复
2.openEuler-22.03-LTS-SP3(3.2.3):正常修复
3.openEuler-22.03-LTS-SP4(3.2.3):正常修复
4.openEuler-24.03-LTS(3.2.3):正常修复
5.openEuler-24.03-LTS-Next(3.2.3):正常修复
6.openEuler-24.03-LTS-SP1(3.2.3):正常修复
7.openEuler-24.03-LTS-SP2(3.2.3):正常修复
8.openEuler-20.03-LTS-SP4(3.2.0):不修复-特殊原因导致不再修复

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1527

src-openEuler/cobbler

内容风险标识

评论 (13)

src-openEuler/cobbler .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-45081

评论 (13)

搜索帮助

src-openEuler/cobbler