Description
A flaw was found in Cockpit in versions prior to 260 in the way it handles the certificate verification performed by the System Security Services Daemon (SSSD). This flaw allows client certificates to authenticate successfully, regardless of the Certificate Revocation List (CRL) configuration or the certificate status. The highest threat from this vulnerability is to confidentiality.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | cockpit | cockpit versions prior to 260 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | cockpit | 260-1 | — |
| Debian 13 | cockpit | 260-1 | — |
| Debian 12 | cockpit | 260-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | cockpit | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | cockpit +4 | 264.1-1.el8 | RHSA-2022:2008 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | cockpit +4 | 264.1-1.el8 | ALSA-2022:2008 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | cockpit | 264.1-1.el8 | RLSA-2022:2008 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | cockpit +4 | 264.1-1.0.1.el8 | ELSA-2022-2008 |
Advisories 4
- ALSA-2022:2008 Moderate: cockpit security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2022:2008 Moderate: cockpit security, bug fix, and enhancement update Rocky Linux Security Advisories · Feb 5, 2026
- RHSA-2022:2008 Red Hat Security Advisory: cockpit security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2022-2008 Moderate: cockpit security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022