CVE-2024-2947

Name of the Vulnerable Software and Affected Versions Cockpit versions 270 and newer

Description A flaw was found in Cockpit, where deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue allows an attacker to execute arbitrary commands.

Recommendations For Cockpit versions 270 and newer, consider disabling the sosreport deletion feature via the Cockpit web interface until a patch is available. Restrict access to the Cockpit web interface to minimize the risk of exploitation. Avoid using crafted names when deleting sosreports to prevent command injection.