CVE-2024-0567

A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack.

The issue is marked as moderate because it involves a vulnerability in GnuTLS, specifically affecting Cockpit, which utilizes GnuTLS. The vulnerability arises when a certificate chain with distributed trust is rejected during validation using cockpit-certificate-ensure. Although this flaw could potentially be exploited by an unauthenticated remote attacker to trigger a denial of service attack on the client, it's important to note that specific server configurations are required for client authentication requests.

This is a bug in the GnuTLS library, Cockpit does not copy this code, but uses the shared lib at runtime. Hence, patching gnutls is necessary and sufficient to address this, hance Cockpit is not affected by this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.