Red Hat Enterprise Linux (cockpit): Schwachstelle ermöglicht Privilegieneskalation

Summary

Product

Vulnerabilities 1

• High 7.3
  CVE-2024-2947

  Cockpit: command injection when deleting a sosreport with a crafted name

  A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian
  Mar 28, 2024

Revision history

1. 2024-06-11 #3

   Neue Updates von Red Hat aufgenommen

2. 2024-06-06 #2

   Neue Updates von Oracle Linux aufgenommen

3. 2024-06-05 #1

   Initiale Fassung

References

• Red Hat Security Advisory RHSA-2024:3667 vom 2024-06-05
  https://access.redhat.com/errata/RHSA-2024:3667
• Red Hat Bugzilla – Bug 2271614
  https://bugzilla.redhat.com/show_bug.cgi?id=2271614
• Red Hat Bugzilla – Bug 2271614
  https://access.redhat.com/security/cve/CVE-2024-2947
• Oracle Linux Security Advisory ELSA-2024-3667 vom 2024-06-07
  http://linux.oracle.com/errata/ELSA-2024-3667.html
• Red Hat Security Advisory RHSA-2024:3843 vom 2024-06-12
  https://access.redhat.com/errata/RHSA-2024:3843
• Oracle Linux Security Advisory ELSA-2024-3843 vom 2024-06-12
  https://linux.oracle.com/errata/ELSA-2024-3843.html