CVE-2019-3804
Fixed in a distro release EPSS 5%CVSS 7.5
It was found that cockpit before version 184 used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.
Products: cockpit-project cockpit, fedoraproject fedora, redhat virtualization
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cockpit | 184-1 |
| Debian 13 | cockpit | 184-1 |
| Debian 14 | cockpit | 184-1 |
| Red Hat Enterprise Linux 7 | cockpit | 0:173.2-1.el7 |
| Red Hat Enterprise Linux 7 | cockpit-bridge | 0:173.2-1.el7 |
| Red Hat Enterprise Linux 7 | cockpit-debuginfo | 0:173.2-1.el7 |
| Red Hat Enterprise Linux 7 | cockpit-doc | 0:173.2-1.el7 |
| Red Hat Enterprise Linux 7 | cockpit-machines-ovirt | 0:173.2-1.el7 |
| Red Hat Enterprise Linux 7 | cockpit-system | 0:173.2-1.el7 |
| Red Hat Enterprise Linux 7 | cockpit-ws | 0:173.2-1.el7 |
| Red Hat Enterprise Linux 7 | redhat-release-virtualization-host | 0:4.3-0.8.el7 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host | 0:4.3-20190610.0.el7_6 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update | 0:4.3-20190610.0.el7_6 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update-placeholder | 0:4.3-0.8.el7 |
| Red Hat Enterprise Linux 7 | rhvm-appliance | 2:4.3-20190605.0.el7 |
| Ubuntu 18.04 LTS | cockpit | no fix |
| Ubuntu 20.04 LTS | cockpit | no fix |
| Ubuntu 22.04 LTS | cockpit | no fix |