Red Hat Security Advisory

RHSA-2022:2008

cockpit security, bug fix, and enhancement update

Released 2022-05-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) cockpit-264.1-1.el8, cockpit-bridge-264.1-1.el8, cockpit-doc-264.1-1.el8 +2

Fixes 2 records

TI-2021-02633 CVE-2021-3698 · GHSA-w9ph-5m4x-c49r

Improper certificate validation in cockpit

LOW 34

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00704 Published 2022-03-08 Partial fix CWE-295

TI-2021-02602 CVE-2021-3660 · GHSA-5m9v-2hhc-h2wj

Clickjacking in cockpit

LOW 23

Cockpit (and its plugins) do not seem to protect itself against clickjacking.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.01261 Published 2022-03-07 Partial fix CWE-1021