PT-2022-10608 · Cockpit+7 · Cockpit+7

Guilherme De Almeida Suckevicz · Published 2022-03-08 · Updated 2026-01-29 · CVE-2021-3698

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cockpit versions prior to 260

Description A flaw was found in the way Cockpit handles certificate verification performed by the System Security Services Daemon (SSSD), allowing client certificates to authenticate successfully regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this issue is to confidentiality.

Recommendations For versions prior to 260, update to version 260 or later to resolve the issue. As a temporary workaround, consider restricting the use of client certificates until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALSA-2022:2008

ALT-PU-2022-3242

CESA-2022_2008

CVE-2021-3698

MGASA-2022-0202

RHSA-2022:2008

RHSA-2022_2008

RLSA-2022:2008

Affected Products

Alt Linux

Almalinux

Centos

Cockpit

Debian

Red Hat

Red Os

Rocky Linux

References · 34

• https://security-tracker.debian.org/tracker/CVE-2021-3698 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-2008.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3698 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3698 · Security Note
• https://osv.dev/vulnerability/MGASA-2022-0202 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-2008.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-3698 · Security Note
• https://osv.dev/vulnerability/ALSA-2022:2008 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-3698 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-3698 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:2008 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0202.html · Security Note
• https://osv.dev/vulnerability/RLSA-2022:2008 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/EQMXNPLHTVOJTHN77TVX6PJKES73UN4F · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3698 · Vendor Advisory