CVE-2021-3698CWE-295

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD)

published March 8, 2022

CVSS
—
EPSS
1%
Percentile
52.8
In the wild
Unconfirmed
What it is

A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00704 · 52.8th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2022-03-08T14:07Z
EPSS history
Timeline
  • 08 MAR 14:07Z
    A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD)
    cvelistv5