Bug 1663567 (CVE-2019-3804)
| Summary: | CVE-2019-3804 cockpit: Crash when parsing invalid base64 headers | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Pedro Sampaio <psampaio> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | abhgupta, ahardin, bleanhar, bmcclain, ccoleman, dbaker, dblechte, dedgar, dfediuck, dperpeet, eedri, eparis, ichavero, jgoulding, jokerman, mchappel, mgoldboi, michal.skrivanek, mpitt, psampaio, pvolpe, sbonazzo, security-response-team, sherold, stefw, sthangav, trankin, yturgema |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | cockpit 184 | Doc Type: | If docs needed, set a value |
| Doc Text: |
It was found that cockpit used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:44:42 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1663712, 1663713, 1663714, 1664193, 1664525, 1672296 | ||
| Bug Blocks: | 1663569 | ||
|
Description
Pedro Sampaio
2019-01-04 21:46:29 UTC
Created cockpit tracking bugs for this issue: Affects: fedora-all [bug 1663713] External References: https://github.com/cockpit-project/cockpit/pull/10819 > Fixes are already in 7.6 and 8.0.0 dist-git branches, filing trackers for RHSA purposes...
For the record: It's already fixed in 8.0.0 (and thus in dist-git), but it is *not* yet applied to the 7.6 dist-git branch. It is only fixed in the *upstream* rhel-7.6 branch (which is what we'll upload for 7.6.3).
Normally I'd fix this through regular 7.6.3 updates in few weeks, or do you want an out-of-band update?
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:0482 https://access.redhat.com/errata/RHSA-2019:0482 Statement: Red Hat Enterprise Linux (RHEL) ships binary packages built from the cockpit source RPM, which was affected by this flaw and subsequently updated to address the issue. All OpenShift Container Platform (OCP) versions to date ship with an image that contains a cockpit-kubernetes RPM, built separately from the same cockpit SRPM. The cockpit-kubernetes RPM is not affected by this vulnerability as it does not contain the affected code, thus OCP is also marked "not affected". Updates for all other cockpit RPMs should be applied from the appropriate RHEL channels. This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 Via RHSA-2019:1569 https://access.redhat.com/errata/RHSA-2019:1569 This issue has been addressed in the following products: Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 Via RHSA-2019:1571 https://access.redhat.com/errata/RHSA-2019:1571 |