A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.
CVSS Details
- CVSS 3.1 Base Score: 3.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade cockpitUpgrade cockpit-pcpUpgrade cockpit-bridgeUpgrade cockpit-docUpgrade cockpit-packagekitUpgrade cockpit-systemUpgrade cockpit-storagedUpgrade cockpit-ws | Nov 19, 2024 | Jul 3, 2024 |
| Debian | — | Upgrade cockpit | Sep 2, 2024 | Jul 3, 2024 |
| Oracle_linux | — | Upgrade cockpit-docUpgrade cockpit-storagedUpgrade cockpit-bridgeUpgrade cockpit-systemUpgrade cockpit-packagekitUpgrade cockpit-pcpUpgrade cockpitUpgrade cockpit-ws | Nov 21, 2024 | Jul 3, 2024 |
| Redhat_linux | — | Upgrade cockpit-bridgeNo solution existsUpgrade cockpitUpgrade cockpit-packagekitUpgrade cockpit-debugsourceUpgrade cockpit-wsUpgrade cockpit-debuginfoUpgrade cockpit-pcpUpgrade cockpit-storagedUpgrade cockpit-systemUpgrade cockpit-doc | Nov 13, 2024 | Jul 3, 2024 |
| Rocky_linux | — | Upgrade cockpit-debugsourceUpgrade cockpit-debuginfoUpgrade cockpit-bridgeUpgrade cockpit-pcpUpgrade cockpit-wsUpgrade cockpit | Mar 18, 2025 | Jul 3, 2024 |
| Suse | — | Upgrade cockpit-selinuxUpgrade cockpit-systemUpgrade cockpit-pcpUpgrade cockpit-docUpgrade cockpit-develUpgrade cockpit-kdumpUpgrade cockpit-firewalldUpgrade cockpit-networkmanagerUpgrade cockpit-ws-selinuxUpgrade cockpit-storagedUpgrade cockpitUpgrade cockpit-packagekitUpgrade cockpit-wsUpgrade cockpit-bridge | Jul 22, 2024 | Jul 3, 2024 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jul 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub