Advisory ROSA-SA-2023-2280

Software: cockpit 264.2
OS: ROSA Virtualization 2.1

package_evr_string: cockpit-264.2-1.0.1.rv3c.src.rpm

CVE-ID: CVE-2021-3660
BDU-ID: 2021-04029
CVE-Crit: MEDIUM
CVE-DESC.: A manager vulnerability for Cockpit servers is related to errors in the display of the user interface or frames. Exploitation of the vulnerability could allow an attacker acting remotely to inject malicious code
CVE-STATUS: Fixed
CVE-REV: To close, run the yum update cockpit command

CVE-ID: CVE-2021-3698
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: In Cockpit versions prior to 260, a flaw was discovered in the way the System Security Services Daemon (SSSD) handles certificate validation. This flaw allows client certificates to successfully authenticate regardless of the configuration of the certificate revocation list (CRL) or the state of the certificate. The highest threat posed by this vulnerability is privacy related.
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update cockpit command