Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Details of issue NIXPKGS-2025-0011

NIXPKGS-2025-0011
published on
Permalink CVE-2024-2947
7.3 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
updated 6 months, 3 weeks ago by @Erethon Activity log
  • Created automatic suggestion 9 months, 3 weeks ago
  • @Erethon dismissed 9 months, 3 weeks ago
  • @Erethon accepted 9 months, 3 weeks ago
  • @Erethon published on GitHub 6 months, 3 weeks ago
Cockpit: command injection when deleting a sosreport with a crafted name

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

References

Affected products

cockpit
  • *
  • *
  • ==314

Matching in nixpkgs