OESA-2026-2907

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-2907
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-2907.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-2907
Upstream
  • CVE-2026-4802
Published
2026-07-09T12:50:17Z
Modified
2026-07-09T13:00:07.338504800Z
Summary
cockpit security update
Details

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package.

Security Fix(es):

A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.(CVE-2024-2947)

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.(CVE-2026-4802)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / cockpit

Package

Name
cockpit
Purl
pkg:rpm/openEuler/cockpit&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
309-8.oe2403sp1

Ecosystem specific 

{
    "noarch": [
        "cockpit-help-309-8.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "cockpit-309-8.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "cockpit-309-8.oe2403sp1.x86_64.rpm",
        "cockpit-debuginfo-309-8.oe2403sp1.x86_64.rpm",
        "cockpit-debugsource-309-8.oe2403sp1.x86_64.rpm",
        "cockpit-devel-309-8.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "cockpit-309-8.oe2403sp1.aarch64.rpm",
        "cockpit-debuginfo-309-8.oe2403sp1.aarch64.rpm",
        "cockpit-debugsource-309-8.oe2403sp1.aarch64.rpm",
        "cockpit-devel-309-8.oe2403sp1.aarch64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-2907.json"