Improper Verification of Cryptographic Signature The advisory has been revoked - it doesn't affect any version of package cockpit-doc (opens in a new tab)

Threat Intelligence

1.39% (72^nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-RHEL8-COCKPITDOC-6158852
published16 Jan 2024
disclosed16 Jan 2024

Report a new vulnerability Found a mistake?

Introduced: 16 Jan 2024

CVE-2024-0567 (opens in a new tab) CWE-347 (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:8.

NVD Description

Note: Versions mentioned in the description apply only to the upstream cockpit-doc package and not the cockpit-doc package as distributed by RHEL.

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.