CVE-2021-3698

EUVD-2021-26983
A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
cockpit-projectcockpit
𝑥
< 260
redhatenterprise_linux
8.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
cockpit
bookworm
287.1-0+deb12u3
fixed
bookworm (security)
287.1-0+deb12u2
fixed
bullseye
no-dsa
buster
not-affected
sid
327-1
fixed
trixie
327-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
cockpit
bionic
needs-triage
focal
needs-triage
hirsute
ignored
impish
ignored
jammy
needs-triage
kinetic
ignored
lunar
ignored
mantic
ignored
noble
needs-triage
trusty
dne
xenial
ignored
Common Weakness Enumeration
References
https://bugzilla.redhat.com/show_bug.cgi?id=1992149
https://bugzilla.redhat.com/show_bug.cgi?id=1992149