1. Home
  2. CVE Database
  3. CVE-2021-3698
HIGH · 7.5

CVE-2021-3698

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to...

Vulnerability Description

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Cockpit-ProjectCockpit< 260
RedhatEnterprise Linux8.0

Related Weaknesses (CWE)

CWE-295

References

FAQ

What is CVE-2021-3698?

CVE-2021-3698 is a vulnerability with a CVSS score of 7.5 (HIGH). A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to...

How severe is CVE-2021-3698?

CVE-2021-3698 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-3698?

Check the references section above for vendor advisories and patch information. Affected products include: Cockpit-Project Cockpit, Redhat Enterprise Linux.