Detections
Analytics

Rocky Linux 8 : cockpit (RLSA-2022:2008)

high Nessus Plugin ID 161349

Synopsis

The remote Rocky Linux host is missing one or more security updates.

Description

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:2008 advisory.

 - A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality. (CVE-2021-3698)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://errata.rockylinux.org/RLSA-2022:2008

https://bugzilla.redhat.com/show_bug.cgi?id=1792270

https://bugzilla.redhat.com/show_bug.cgi?id=1980688

https://bugzilla.redhat.com/show_bug.cgi?id=1992149

https://bugzilla.redhat.com/show_bug.cgi?id=2004041

https://bugzilla.redhat.com/show_bug.cgi?id=2008208

https://bugzilla.redhat.com/show_bug.cgi?id=2016998

https://bugzilla.redhat.com/show_bug.cgi?id=2018382

https://bugzilla.redhat.com/show_bug.cgi?id=2018384

https://bugzilla.redhat.com/show_bug.cgi?id=2018417

https://bugzilla.redhat.com/show_bug.cgi?id=2029982

https://bugzilla.redhat.com/show_bug.cgi?id=2056386

Plugin Details

Severity: High

ID: 161349

File Name: rocky_linux_RLSA-2022-2008.nasl

Version: 1.3

Type: local

Published: 5/18/2022

Updated: 11/6/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-3698

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:rocky:linux:cockpit, p-cpe:/a:rocky:linux:cockpit-bridge, p-cpe:/a:rocky:linux:cockpit-debuginfo, p-cpe:/a:rocky:linux:cockpit-debugsource, p-cpe:/a:rocky:linux:cockpit-doc, p-cpe:/a:rocky:linux:cockpit-system, p-cpe:/a:rocky:linux:cockpit-ws, cpe:/o:rocky:linux:8

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RockyLinux/release, Host/RockyLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/18/2022

Vulnerability Publication Date: 3/10/2022

Reference Information

CVE: CVE-2021-3660, CVE-2021-3698