CVE-2021-40323: 
Python vulnerability analysis and mitigation

Cobbler before version 3.3.0 contained a critical vulnerability that allowed log poisoning and subsequent Remote Code Execution (RCE) through an XMLRPC method that logs to the logfile for template injection. The vulnerability was discovered in August 2021 and was assigned CVE-2021-40323 (NVD, MITRE).

The vulnerability received a CVSS v3.1 base score of 9.8 (Critical), with attack vector being Network, attack complexity Low, requiring no privileges or user interaction, and having High impact on confidentiality, integrity, and availability. The vulnerability specifically affected the XMLRPC interface's logging functionality, which could be exploited for template injection attacks (Ubuntu).

The vulnerability allowed attackers to perform log poisoning attacks that could lead to Remote Code Execution with high privileges. This could potentially give attackers complete control over the affected system, with high impacts on system confidentiality, integrity, and availability (NVD).

The vulnerability was fixed in Cobbler version 3.3.0. The fix included security improvements to prevent log poisoning and template injection attacks. Users were advised to upgrade to version 3.3.0 or later to address this vulnerability (Cobbler Release).