Arbitrary Command Injection Affecting cockpit-system package, versions <0:310.4-1.el8_10


Severity

Recommended
medium

Based on CentOS security rating.

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Command Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS8-COCKPITSYSTEM-6512175
  • published28 Mar 2024
  • disclosed27 Mar 2024

Introduced: 27 Mar 2024

CVE-2024-2947  (opens in a new tab)
CWE-77  (opens in a new tab)

How to fix?

Upgrade Centos:8 cockpit-system to version 0:310.4-1.el8_10 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cockpit-system package and not the cockpit-system package as distributed by Centos. See How to fix? for Centos:8 relevant fixed versions and status.

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

CVSS Scores

version 3.1