Certificate Verification Flaw in Cockpit by Red Hat
CVE-2021-3698

7.5HIGH

Key Information:

Vendor

Cockpit-project

Status
Cockpit
Vendor
CVE Published:
8 March 2022

What is CVE-2021-3698?

A vulnerability exists in Cockpit that impacts the System Security Services Daemon (SSSD) in versions prior to 260. This issue arises from improper handling of client certificate verifications, allowing certificates to authenticate without adhering to the specified Certificate Revocation List (CRL) configurations. Consequently, clients may be granted secure access despite potential revocation statuses, undermining the confidentiality of sensitive information.

Affected Version(s)

cockpit cockpit versions prior to 260

References

https://bugzilla.redhat.com/show_bug.cgi?id=1992149
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.