Resource exhaustion in Cockpit - CVE-2024-6126

Vulnerability identifier: #VU93801

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L]

CVE-ID: CVE-2024-6126

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Cockpit
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openEuler
Anolis OS
Fedora
cockpit-help
cockpit-cockpit-machines-ovirt
cockpit-cockpit-machines
cockpit-devel
cockpit-debugsource
cockpit-debuginfo
cockpit
cockpit-ws
cockpit-bridge
cockpit-bridge-debuginfo
cockpit-ws-debuginfo
cockpit-dashboard
cockpit-system
cockpit-storaged
cockpit-networkmanager
cockpit-selinux
cockpit-sosreport
cockpit-packagekit
cockpit-kdump
cockpit-doc
cockpit-tests
cockpit-pcp
cockpit (Red Hat package)

Install updates from vendor's website.

Cockpit - update to 320
cockpit-help - update to 178-17
cockpit-cockpit-machines-ovirt - update to 178-17
cockpit-cockpit-machines - update to 178-17
cockpit-devel - update to 178-17
cockpit-debugsource - update to 178-17
cockpit-debuginfo - update to 178-17
cockpit - update to 178-17
cockpit-debuginfo - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-debugsource - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-ws - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-bridge - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-bridge-debuginfo - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-ws-debuginfo - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-dashboard - update to 195.12-150300.10.6.1
cockpit-system - addressed in versions 195.12-150300.10.6.1, 251.3-150300.6.3.1, 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-storaged - addressed in versions 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-networkmanager - addressed in versions 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-selinux - addressed in versions 251.3-150400.6.7.1, 251.3-150400.8.3.1, 298-150500.3.6.1
cockpit-system - update to 320-1
cockpit-storaged - update to 320-1
cockpit-sosreport - update to 320-1
cockpit-selinux - update to 320-1
cockpit-packagekit - update to 320-1
cockpit-networkmanager - update to 320-1
cockpit-kdump - update to 320-1
cockpit-doc - update to 320-1
cockpit-ws - update to 320-1
cockpit-tests - update to 320-1
cockpit-pcp - update to 320-1
cockpit-bridge - update to 320-1
cockpit - update to 320-1
cockpit - update to 320-1.fc39
cockpit (Red Hat package) - update to 323.1-1.el9_5

• https://access.redhat.com/security/cve/CVE-2024-6126
• https://bugzilla.redhat.com/show_bug.cgi?id=2292897
• https://github.com/advisories/GHSA-g6h4-j28x-38g5

• Denial of service in Cockpit
• Fedora 39 update for cockpit
• SUSE update for cockpit
• SUSE update for cockpit
• SUSE update for cockpit
• SUSE update for cockpit
• SUSE update for cockpit
• openEuler update for cockpit
• Red Hat Enterprise Linux 9 update for cockpit
• Anolis OS update for cockpit