This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-3660 →

DEBIAN-CVE-2021-3660

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another websit...

Original description

The description as published by the source.

Cockpit (and its plugins) do not seem to protect itself against clickjacking. It is possible to render a page from a cockpit server via another website, inside an HTML entry. This may be used by a malicious website in clickjacking or similar attacks.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cockpit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"254-1"}]}]

Debian:13 cockpit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"254-1"}]}]

Debian:14 cockpit

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"254-1"}]}]

References

advisory security-tracker.debian.org