CVE-2024-2947
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-2947
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-2947.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-2947
- Related
- Published
- 2024-03-28T19:15:48Z
- Modified
- 2025-01-08T09:42:58.329962Z
- Summary
- [none]
- Details
-
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.
- References
-
- https://access.redhat.com/errata/RHSA-2024:3667
- https://access.redhat.com/errata/RHSA-2024:3843
- https://bugzilla.redhat.com/show_bug.cgi?id=2271614
- https://access.redhat.com/security/cve/CVE-2024-2947
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNG7GXOZI6QH3OIQJYAYDB3CRRGH37Q5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3Q5SDIFACAY4VHACN5MMCMT3A53A3FB/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36/
- https://security-tracker.debian.org/tracker/CVE-2024-2947
Affected packages
Debian:12 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source
Debian:13 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed314-1
Affected versions
Other
287-1
289-1
290-1
291-1
292-1
293-1
294-1
295-1
296-1
297-1~bpo12+1
297-1
298-1
299-1~bpo12+1
299-1
300-1
301-1~bpo12+1
301-1
302-1
303-1~bpo12+1
303-1
304-1
305-1~bpo12+1
305-1
306-1~bpo12+1
306-1
307-1~bpo12+1
307-1
308-1~bpo12+1
308-1
309-1~bpo12+1
309-1
310-1
311-1~bpo12+1
311-1
312-1
313-1
288.*
288.1-1
294.*
294.1-1
300.*
300.1-1~bpo12+1
300.1-1
310.*
310.1-1~bpo12+1
310.1-1