It was found that cockpit before version 184 used glibs base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.
Weakness
The product does not initialize a critical resource.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cockpit | Cockpit-project | * | 184 (excluding) |
| Red Hat Enterprise Linux 7 | RedHat | cockpit-0:173.2-1.el7 | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | redhat-release-virtualization-host-0:4.3-0.8.el7 | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | redhat-virtualization-host-0:4.3-20190610.0.el7_6 | * |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | RedHat | rhvm-appliance-0:4.3-20190605.0.el7 | * |
| Cockpit | Ubuntu | bionic | * |
| Cockpit | Ubuntu | cosmic | * |
| Cockpit | Ubuntu | disco | * |
| Cockpit | Ubuntu | eoan | * |
| Cockpit | Ubuntu | focal | * |
| Cockpit | Ubuntu | groovy | * |
| Cockpit | Ubuntu | hirsute | * |
| Cockpit | Ubuntu | impish | * |
| Cockpit | Ubuntu | kinetic | * |
| Cockpit | Ubuntu | upstream | * |
Potential Mitigations
References
- https://access.redhat.com/errata/RHSA-2019:1569
- https://access.redhat.com/errata/RHSA-2019:1571
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3804
- https://github.com/cockpit-project/cockpit/commit/c51f6177576d7e12
- https://github.com/cockpit-project/cockpit/pull/10819
- https://access.redhat.com/errata/RHSA-2019:1569
- https://access.redhat.com/errata/RHSA-2019:1571
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3804
- https://github.com/cockpit-project/cockpit/commit/c51f6177576d7e12
- https://github.com/cockpit-project/cockpit/pull/10819