Summary
Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.
Security Fix(es):
* cockpit: command injection when deleting a sosreport with a crafted name (CVE-2024-2947)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | cockpit | 311.2-1.el9_4 |
| AlmaLinux · 9 | cockpit-bridge | 311.2-1.el9_4 |
| AlmaLinux · 9 | cockpit-doc | 311.2-1.el9_4 |
| AlmaLinux · 9 | cockpit-packagekit | 311.2-1.el9_4 |
| AlmaLinux · 9 | cockpit-pcp | 311.2-1.el9_4 |
| AlmaLinux · 9 | cockpit-storaged | 311.2-1.el9_4 |
| AlmaLinux · 9 | cockpit-system | 311.2-1.el9_4 |
| AlmaLinux · 9 | cockpit-ws | 311.2-1.el9_4 |
Vulnerabilities 1
-
High 7.3
Cockpit: command injection when deleting a sosreport with a crafted name
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.