{"id":"CVE-2024-6126","title":"Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option","summary":"A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.","severity":"low","cvss":3.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-400"],"vendor":"Red Hat","product":"cockpit","affected":["cockpit (all versions)","cockpit (all versions)","cockpit (all versions)","cockpit","cockpit","cockpit (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-07-08T14:14:09.489434Z"},"published":"2024-07-03","updated":"2026-11-07","sourceUpdated":"2026-11-07T11:32:25.041Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-6126","references":[{"url":"https://access.redhat.com/errata/RHSA-2024:9325","label":"RHSA-2024:9325"},{"url":"https://access.redhat.com/security/cve/CVE-2024-6126"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2292897","label":"RHBZ#2292897"}],"tags":["cve.org"],"epss":0.00274,"epssPercentile":0.19881,"ingestedAt":"2026-11-07T12:16:41.113Z","slug":"CVE-2024-6126","body":"## Overview\n\nA flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.\n\n## Affected\n\n- `cockpit (all versions)`\n- `cockpit (all versions)`\n- `cockpit (all versions)`\n- `cockpit`\n- `cockpit`\n- `cockpit (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nDisable pam_env's `user_readenv` option in PAM config.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":17.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}