Lucene search

[email protected]CVE-2021-3698

HistoryMar 10, 2022 - 5:42 p.m.

CVE-2021-3698

2022-03-1017:42:57

CWE-295

[email protected]

web.nvd.nist.gov

cockpit

certificate verification

vulnerability

confidentiality

cve-2021-3698

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

41.8%

JSON

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

Affected configurations

Vulners

NVD

Node

cockpit-projectcockpit

VendorProductVersionCPE
cockpit\-projectcockpit*cpe:2.3:a:cockpit\-project:cockpit:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cockpit\-project	cockpit	*	cpe:2.3:a:cockpit\-project:cockpit::::::::

CNA Affected

[
  {
    "product": "cockpit",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "cockpit versions prior to 260"
      }
    ]
  }
]