CVE-2024-2947 - OpenCVE

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
cockpit-0:310.4-1.el8_10	cpe:/o:redhat:enterprise_linux:8	RHSA-2024:3667	2024-06-06T00:00:00Z
Red Hat Enterprise Linux 9
cockpit-0:311.2-1.el9_4	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:3843	2024-06-11T00:00:00Z
cockpit-0:311.2-1.el9_4	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:3843	2024-06-11T00:00:00Z

References

Link	Providers
https://access.redhat.com/errata/RHSA-2024:3667
https://access.redhat.com/errata/RHSA-2024:3843
https://access.redhat.com/security/cve/CVE-2024-2947
https://bugzilla.redhat.com/show_bug.cgi?id=2271614
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNG7GXOZI6QH3OIQJYAYDB3CRRGH37Q5/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3Q5SDIFACAY4VHACN5MMCMT3A53A3FB/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36/
https://nvd.nist.gov/vuln/detail/CVE-2024-2947
https://www.cve.org/CVERecord?id=CVE-2024-2947

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2024-03-28T18:31:59.249Z

Updated: 2024-09-16T18:40:58.509Z

Reserved: 2024-03-26T16:48:38.370Z

Link: CVE-2024-2947

Vulnrichment

Updated: 2024-08-01T19:32:42.293Z

NVD

Status : Awaiting Analysis

Published: 2024-03-28T19:15:48.693

Modified: 2024-09-16T19:16:09.530

Link: CVE-2024-2947

Redhat

Severity : Moderate

Publid Date: 2024-03-27T00:00:00Z

Links: CVE-2024-2947 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2947", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-03-26T16:48:38.370Z", "datePublished": "2024-03-28T18:31:59.249Z", "dateUpdated": "2024-09-16T18:40:58.509Z"}, "containers": {"cna": {"title": "Cockpit: command injection when deleting a sosreport with a crafted name", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:310.4-1.el8_10", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:8::baseos"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:311.2-1.el9_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "affected", "versions": [{"version": "0:311.2-1.el9_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream"]}, {"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "cockpit", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:enterprise_linux:7"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:3667", "name": "RHSA-2024:3667", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:3843", "name": "RHSA-2024:3843", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-2947", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271614", "name": "RHBZ#2271614", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2024-03-27T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "workarounds": [{"lang": "en", "value": "Do not remove SOS reports with strange names from the Cockpit web interface."}], "timeline": [{"lang": "en", "time": "2024-03-22T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-03-27T00:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank xcuter (NAVER Cloud Security Analysis) for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-09-16T18:40:58.509Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-01T17:32:00.346165Z", "id": "CVE-2024-2947", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T17:32:13.401Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:32:42.293Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:3667", "name": "RHSA-2024:3667", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:3843", "name": "RHSA-2024:3843", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-2947", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271614", "name": "RHBZ#2271614", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNG7GXOZI6QH3OIQJYAYDB3CRRGH37Q5/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3Q5SDIFACAY4VHACN5MMCMT3A53A3FB/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:3667", "name": "RHSA-2024:3667", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:3843", "name": "RHSA-2024:3843", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-2947", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271614", "name": "RHBZ#2271614", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KNG7GXOZI6QH3OIQJYAYDB3CRRGH37Q5/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N3Q5SDIFACAY4VHACN5MMCMT3A53A3FB/", "tags": ["x_transferred"]}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PIQY2HGDJW2JY27ALTS4GEVZZJJ4XQ36/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:32:42.293Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-2947", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-01T17:32:00.346165Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T17:32:09.833Z"}}], "cna": {"title": "Cockpit: command injection when deleting a sosreport with a crafted name", "credits": [{"lang": "en", "value": "Red Hat would like to thank xcuter (NAVER Cloud Security Analysis) for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/o:redhat:enterprise_linux:8::baseos"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "0:310.4-1.el8_10", "lessThan": "*", "versionType": "rpm"}], "packageName": "cockpit", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:311.2-1.el9_4", "lessThan": "*", "versionType": "rpm"}], "packageName": "cockpit", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9::baseos", "cpe:/a:redhat:enterprise_linux:9::appstream"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:311.2-1.el9_4", "lessThan": "*", "versionType": "rpm"}], "packageName": "cockpit", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "cockpit", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-03-22T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-03-27T00:00:00+00:00", "value": "Made public."}], "datePublic": "2024-03-27T00:00:00+00:00", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:3667", "name": "RHSA-2024:3667", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2024:3843", "name": "RHSA-2024:3843", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-2947", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271614", "name": "RHBZ#2271614", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Do not remove SOS reports with strange names from the Cockpit web interface."}], "descriptions": [{"lang": "en", "value": "A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-09-16T18:40:58.509Z"}, "x_redhatCweChain": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}}, "cveMetadata": {"cveId": "CVE-2024-2947", "state": "PUBLISHED", "dateUpdated": "2024-09-16T18:40:58.509Z", "dateReserved": "2024-03-26T16:48:38.370Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-03-28T18:31:59.249Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{"acknowledgement": "Red Hat would like to thank xcuter (NAVER Cloud Security Analysis) for reporting this issue.", "affected_release": [{"advisory": "RHSA-2024:3667", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "cockpit-0:310.4-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2024-06-06T00:00:00Z"}, {"advisory": "RHSA-2024:3843", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "cockpit-0:311.2-1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-06-11T00:00:00Z"}, {"advisory": "RHSA-2024:3843", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "cockpit-0:311.2-1.el9_4", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-06-11T00:00:00Z"}], "bugzilla": {"description": "cockpit: command injection when deleting a sosreport with a crafted name", "id": "2271614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2271614"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "status": "verified"}, "cwe": "CWE-77", "details": ["A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.", "A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer."], "mitigation": {"lang": "en:us", "value": "Do not remove SOS reports with strange names from the Cockpit web interface."}, "name": "CVE-2024-2947", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "cockpit", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2024-03-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-2947\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-2947"], "statement": "The Cockpit package, as shipped in Red Hat Enterprise Linux 7, 8.2, 8.4, and 8.6, is not affected by this vulnerability because the vulnerable code was introduced in a newer version of Cockpit.", "threat_severity": "Moderate", "upstream_fix": "cockpit 314"}