CVE-2021-3698

Name of the Vulnerable Software and Affected Versions Cockpit versions prior to 260

Description A flaw was found in the way Cockpit handles certificate verification performed by the System Security Services Daemon (SSSD), allowing client certificates to authenticate successfully regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this issue is to confidentiality.

Recommendations For versions prior to 260, update to version 260 or later to resolve the issue. As a temporary workaround, consider restricting the use of client certificates until a patch is available.