Bug 1663567 (CVE-2019-3804) - CVE-2019-3804 cockpit: Crash when parsing invalid base64 headers
Summary: CVE-2019-3804 cockpit: Crash when parsing invalid base64 headers
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-3804
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1663712 1663713 1663714 1664193 1664525 1672296
Blocks: 1663569
TreeView+ depends on / blocked
 
Reported: 2019-01-04 21:46 UTC by Pedro Sampaio
Modified: 2022-10-02 21:48 UTC (History)
28 users (show)

Fixed In Version: cockpit 184
Doc Type: If docs needed, set a value
Doc Text:
It was found that cockpit used glib's base64 decode functionality incorrectly resulting in a denial of service attack. An unauthenticated attacker could send a specially crafted request with an invalid base64-encoded cookie which could cause the web service to crash.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:44:42 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:0482 0 None None None 2019-03-13 12:54:25 UTC
Red Hat Product Errata RHSA-2019:1569 0 None None None 2019-06-20 14:48:54 UTC
Red Hat Product Errata RHSA-2019:1571 0 None None None 2019-06-20 14:49:04 UTC

Description Pedro Sampaio 2019-01-04 21:46:29 UTC 
A flaw was found in cockpit web server that may lead to denial of server through sending crafted invalid base64 headers.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1659542

Upstream issue:

https://github.com/cockpit-project/cockpit/pull/10819

Upstream patch:

https://github.com/cockpit-project/cockpit/commit/c51f6177576d7e12
Comment 5 Doran Moppert 2019-01-07 00:49:33 UTC 
Created cockpit tracking bugs for this issue:

Affects: fedora-all [bug 1663713]
Comment 7 Doran Moppert 2019-01-07 03:04:13 UTC 
External References:

https://github.com/cockpit-project/cockpit/pull/10819
Comment 8 Martin Pitt 2019-01-07 07:27:51 UTC 
> Fixes are already in 7.6 and 8.0.0 dist-git branches, filing trackers for RHSA purposes...

For the record: It's already fixed in 8.0.0 (and thus in dist-git), but it is *not* yet applied to the 7.6 dist-git branch. It is only fixed in the *upstream* rhel-7.6 branch (which is what we'll upload for 7.6.3).

Normally I'd fix this through regular 7.6.3 updates in  few weeks, or do you want an out-of-band update?
Comment 13 errata-xmlrpc 2019-03-13 12:54:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0482 https://access.redhat.com/errata/RHSA-2019:0482
Comment 24 Dave Baker 2019-04-18 02:13:50 UTC 
Statement:

Red Hat Enterprise Linux (RHEL) ships binary packages built from the cockpit source RPM, which was affected by this flaw and subsequently updated to address the issue.

All OpenShift Container Platform (OCP) versions to date ship with an image that contains a cockpit-kubernetes RPM, built separately from the same cockpit SRPM.  The cockpit-kubernetes RPM is not affected by this vulnerability as it does not contain the affected code, thus OCP is also marked "not affected".  Updates for all other cockpit RPMs should be applied from the appropriate RHEL channels.
Comment 25 errata-xmlrpc 2019-06-20 14:48:52 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2019:1569 https://access.redhat.com/errata/RHSA-2019:1569
Comment 26 errata-xmlrpc 2019-06-20 14:49:03 UTC 
This issue has been addressed in the following products:

  Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

Via RHSA-2019:1571 https://access.redhat.com/errata/RHSA-2019:1571
Note You need to log in before you can comment on or make changes to this bug.