CVE-2019-3804
CVE-2019-3804
This page contains facts from public vulnerability sources. Check the original advisory before updating.
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.
CVSS 7.5 · High · EPSS 4.9% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
cockpit
- Versions
- 184: Affected
No fix published
cockpit Debian:12
- Affected ranges
- ECOSYSTEM: < 184-1
Update to 184-1
cockpit Debian:13
- Affected ranges
- ECOSYSTEM: < 184-1
Update to 184-1
cockpit Debian:14
- Affected ranges
- ECOSYSTEM: < 184-1
Update to 184-1
cockpit Ubuntu:18.04:LTS
- Versions
- 151-1
- 156-1
- 157-1
- 158-1
- 160-1
- 161-1
- 162-1
- 163-1
- 164-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit Ubuntu:20.04:LTS
- Versions
- 202.1-1
- 204-1
- 206-1
- 207-1
- 208-1
- 210-1
- 211-1
- 212-1
- 213-1
- 214.1-1
- 215-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
cockpit Ubuntu:22.04:LTS
- Versions
- 252-1
- 256-1
- 257-1
- 258-1
- 259-1
- 260-1
- 261-1
- 262-1
- 263-1
- 264-1
- 264-1ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://access.redhat.com/errata/RHSA-2019:1569
- https://access.redhat.com/errata/RHSA-2019:1571
- https://github.com/cockpit-project/cockpit/pull/10819
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3804
- https://github.com/cockpit-project/cockpit/commit/c51f6177576d7e12
- https://nvd.nist.gov/vuln/detail/CVE-2019-3804