{"id":"CVE-2024-2947","aliases":["ALSA-2024:3667","ALSA-2024:3843","CLSA-2025-1764085222","DEBIAN-CVE-2024-2947","DSA-5655-1","EUVD-2024-27889","GHSA-8rqc-wx6q-m4qc","OESA-2026-2907","OESA-2026-2908","OESA-2026-3098","RHSA-2024:3667","RHSA-2024:3843","RLSA-2024:3667"],"status":"published","title":"Cockpit: command injection when deleting a sosreport with a crafted name","description":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01181,"percentile":0.6799,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2024-03-28T18:31:59Z","modified":"2026-11-05T13:17:02Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"cockpit","fixed_in":["310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-bridge","fixed_in":["310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-doc","fixed_in":["310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-system","fixed_in":["310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"cockpit-ws","fixed_in":["310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-bridge","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-doc","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-packagekit","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-pcp","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-storaged","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-system","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"cockpit-ws","fixed_in":["311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-bridge","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-doc","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-packagekit","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-pcp","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-storaged","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-system","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-tests","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-ws","fixed_in":["286.2-1.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cockpit","fixed_in":["287.1-0+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cockpit","fixed_in":["314-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cockpit","fixed_in":["314-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-bridge","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debuginfo","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debugsource","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-doc","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-system","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-ws","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-debuginfo","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-debugsource","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-packagekit","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-pcp","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-storaged","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-bridge","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debuginfo","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debugsource","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-doc","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-system","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws","fixed_in":["0:311.2-1.el9_4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"cockpit","fixed_in":["0:310.4-1.el8_10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"286.2-1.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"287.1-0+deb12u1"}]}],"versions":["287-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"314-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"314-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"287.1-0+deb12u1"}]}],"versions":["287-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-8.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-8.oe2403sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"309-9.oe2403sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:311.2-1.el9_4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:310.4-1.el8_10"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:3667","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3843","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-2947","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","report","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2271614","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNG7GXOZI6QH3OIQJYAYDB3CRRGH37Q5/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3Q5SDIFACAY4VHACN5MMCMT3A53A3FB/","tags":["x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36/","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2947","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36"},{"url":"https://github.com/advisories/GHSA-8rqc-wx6q-m4qc"},{"url":"https://bugzilla.redhat.com/2271614","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-3667.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-3843.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1764085222.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-2947","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2907","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4802","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2908","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3098","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3667.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-2947","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3843.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:3667","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-2947","title":"Cockpit: command injection when deleting a sosreport with a crafted name","description":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.","status":"published","published":"2024-03-28T18:31:59.249Z","modified":"2026-11-05T12:17:54.091Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2024-27889","description":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.","status":"published","published":"2024-03-28T18:31:59Z","modified":"2026-11-05T12:17:54Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-8rqc-wx6q-m4qc","title":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web...","description":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.","status":"published","published":"2024-03-28T21:30:31Z","modified":"2024-03-30T03:30:45Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:55:44.111751Z"}],"nvd":[{"id":"CVE-2024-2947","description":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.","status":"published","published":"2024-03-28T19:15:48.693Z","modified":"2026-11-05T13:17:02.003Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77"],"updated_at":"2026-11-05T19:55:48.976368Z"}],"osv":[{"id":"DEBIAN-CVE-2024-2947","description":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.","status":"published","published":"2024-03-28T19:15:48.693Z","modified":"2026-11-02T12:02:14.518162096Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"OESA-2026-2907","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)\n\nA flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.175413885Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2908","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)\n\nA flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)","status":"published","published":"2026-07-09T11:11:49Z","modified":"2026-08-18T01:21:15.209260939Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3098","title":"cockpit security update","description":"Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)\n\nA flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)","status":"published","published":"2026-07-19T11:11:59Z","modified":"2026-08-18T01:21:21.165335952Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2024:3667","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2024-09-16T18:41:01Z","modified":"2026-06-03T10:07:44Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3843","title":"Red Hat Security Advisory: cockpit security update","status":"published","published":"2024-09-16T18:41:10Z","modified":"2026-06-26T12:22:22.619387248Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"ALSA-2024:3667","title":"Moderate: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: command injection when deleting a sosreport with a crafted name (CVE-2024-2947)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-06T00:00:00Z","modified":"2026-10-29T11:02:21.264428331Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:3843","title":"Moderate: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: command injection when deleting a sosreport with a crafted name (CVE-2024-2947)","status":"published","published":"2024-06-11T00:00:00Z","modified":"2026-10-29T11:32:10.010415549Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2025-1764085222","title":"cockpit: Fix of CVE-2024-2947","description":"- CVE-2024-2947: fix command injection vulnerability by sanitizing sosreport\n  names during deletion","status":"published","published":"2025-11-25T15:40:26Z","modified":"2026-06-01T00:31:21.734115869Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CVE-2024-2947","description":"A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.","status":"published","published":"2024-03-28T19:15:48Z","modified":"2026-04-10T05:11:52.231473Z","updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"DSA-5655-1","title":"cockpit - security update","status":"published","published":"2024-04-04T00:00:00Z","modified":"2026-03-09T02:10:07.260537Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"RLSA-2024:3667","title":"Moderate: cockpit security update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nSecurity Fix(es):\n\n* cockpit: command injection when deleting a sosreport with a crafted name (CVE-2024-2947)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-06-14T13:59:16.809606Z","modified":"2026-02-04T07:40:22.696299Z","updated_at":"2026-11-02T15:53:24.923365Z"}]}}