{"id":"CVE-2021-3698","aliases":["ALSA-2022:2008","DEBIAN-CVE-2021-3698","EUVD-2021-26983","GHSA-w9ph-5m4x-c49r","MGASA-2022-0202","RHSA-2022:2008","RLSA-2022:2008","UBUNTU-CVE-2021-3698"],"status":"published","title":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate...","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00704,"percentile":0.53733,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2022-03-08T14:07:49Z","modified":"2026-10-29T11:01:18Z","fixes":[{"ecosystem":"Debian:12","package":"cockpit","fixed_in":["260-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cockpit","fixed_in":["260-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cockpit","fixed_in":["260-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"cockpit","fixed_in":["269-1.mga8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"260-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"260-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"260-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"269-1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:264.1-1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["202.1-1","204-1","206-1","207-1","208-1","210-1","211-1","212-1","213-1","214.1-1","215-1"]}],"products":[{"vendor":"cockpit-hq","product":"cockpit"},{"vendor":"cockpit-project","product":"cockpit"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992149","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3698","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w9ph-5m4x-c49r"},{"url":"https://errata.almalinux.org/8/ALSA-2022-2008.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-3660","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-3698","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3698","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0202.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29890","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/EQMXNPLHTVOJTHN77TVX6PJKES73UN4F/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2022:2008","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1792270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1980688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2004041","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2008208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2016998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2018417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2029982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056386","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_2008.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3660","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3698","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2022:2008","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3698","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3698","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-03-08T14:07:49Z","modified":"2024-08-03T17:01:07.967Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:33:04.020035Z"}],"euvd":[{"id":"EUVD-2021-26983","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-03-08T14:07:49Z","modified":"2024-08-03T17:01:07Z","updated_at":"2026-11-03T03:25:12.535968Z"}],"ghsa":[{"id":"GHSA-w9ph-5m4x-c49r","title":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate...","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-03-11T00:02:33Z","modified":"2023-01-27T05:00:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:41:43.766328Z"}],"nvd":[{"id":"CVE-2021-3698","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-03-10T17:42:57.783Z","modified":"2026-06-17T04:05:35.023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:07:05.198719Z"}],"osv":[{"id":"CVE-2021-3698","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-03-10T17:42:57.783Z","modified":"2026-10-24T10:31:05.874600211Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-3698","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-03-10T17:42:57.783Z","modified":"2026-10-23T18:05:22.949601812Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"RHSA-2022:2008","title":"Red Hat Security Advisory: cockpit security, bug fix, and enhancement update","status":"published","published":"2024-09-16T06:39:16Z","modified":"2025-11-22T12:33:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RLSA-2022:2008","title":"Moderate: cockpit security, bug fix, and enhancement update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nThe following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)\n\nSecurity Fix(es):\n\n* cockpit: authenticates with revoked certificates (CVE-2021-3698)\n\n* cockpit: pages vulnerable to clickjacking (CVE-2021-3660)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:44:59Z","modified":"2026-02-05T05:15:11.098097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:24.322216Z"},{"id":"UBUNTU-CVE-2021-3698","description":"A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.","status":"published","published":"2022-03-10T17:42:00Z","modified":"2025-10-24T04:49:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2022:2008","title":"Moderate: cockpit security, bug fix, and enhancement update","description":"Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more.\n\nThe following packages have been upgraded to a later upstream version: cockpit (264.1). (BZ#1984902, BZ#1992620, BZ#2004041, BZ#2008208)\n\nSecurity Fix(es):\n\n* cockpit: authenticates with revoked certificates (CVE-2021-3698)\n\n* cockpit: pages vulnerable to clickjacking (CVE-2021-3660)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2022-05-10T06:44:59Z","modified":"2026-10-29T11:01:18.768591581Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"MGASA-2022-0202","title":"Updated cockpit packages fix security vulnerability","description":"authenticates with revoked certificates (CVE-2021-3698)\n","status":"published","published":"2022-05-25T18:46:18Z","modified":"2026-04-16T04:40:40.67207281Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}