Homepage

Improper Verification of Cryptographic Signature The advisory has been revoked - it doesn't affect any version of package cockpit-system  (opens in a new tab)

Threat Intelligence

EPSS
1.39% (72nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS8-COCKPITSYSTEM-6158851
  • published16 Jan 2024
  • disclosed16 Jan 2024
Report a new vulnerability Found a mistake?

Introduced: 16 Jan 2024

CVE-2024-0567  (opens in a new tab)
CWE-347  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cockpit-system package and not the cockpit-system package as distributed by Centos.

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

References