Summary
cockpit-composer
[45-1.0.1]
- Make per page documentation links point to Oracle Linux [Orabug: 32013095]
[45-1]
- New upstream release
[44-1]
- New upstream release
[43-1]
- New upstream release
[42-1]
- New upstream release
[40-1]
- New upstream release
[39-1]
- New upstream release
[38-1]
- New upstream release
[37-1]
- New upstream release
[35-1]
- New upstream release
[34-1]
- New upstream release
[33-1]
- Add support for OCI upload target
- Update translations
- Update dependencies
[32-1]
- Add Edge Raw, RHEL Installer, Edge Simplified Installer image types
- Improve user account modal responsiveness
- Update tests
- Update minor NPM dependencies
- Update translation files
[31-1]
- Add new ostree image types
- Improve loading state when waiting for api responses
- Improve notification system
- Improve test stability
- Update NPM dependencies
- Update translations
[29-1]
- Add ability to upload to VMWare
- Add support for additional ostree parameters
- Update NPM dependencies
- Add and update translations
- Minor test fixes
[28-1]
- Use sentence case rather than title case
- Add and update tests
- Update translations from weblate
- Update minor NPM dependencies
[27-1]
- Sync with upstream release 27
- Add additional form validation for the Create Image Wizard
- Improve page size dropdown styling
- Improve error state messages
- Update pagination component for pf4
- Add wildcards and support for multiple values to input filter
- Update translations
[22.1-1]
- Patternfly imports are standardized to be consistent with cockpit
- Cancel image build button bug fixed
- Empty components state provides a help message
- Wizard component has bug fixes and is refactored for future scalability
- Test updates
- ESLint upgraded to version 7 and the code style is improved
- Translation files are updated from fedora weblate
- Cockpit-composer's dependency on osbuild-composer is more specific
- Coverity scan is now supported to help improve code quality
- Resolves: #1820539
[21.1-1]
- Support setting parameters (ref and parent) for ostree images
- Loosen restrictions on password strength
- Various UI refinements
[20.1-1]
- Migrate to the osbuild-composer backend
- Supports uploading images to AWS and Azure
[12.1-1]
- Fix integration tests, external test repository URL ceased to exist
- Translation updates rhbz#1784453
- Add documentation URL page help menu
[11-1]
- Show depsolve errors on the blueprints page
- Add labels for additional output types (rhbz#1769154)
- Expose Image Builder on /composer, not /welder
- Define a URL for each tab on a blueprint page
- Provide a link in the image creation notification to the Images tab on the blueprint page
[5-1]
- Fix PropTypes for the homepage
- Code clean up for the list of components
[4-1]
- Add additional blueprint name validation rhbz#1696415
- Fix images not loading on refresh
- Add notification for source repo deletion
- Fix AppStream ID
- Translation updates
[2-1]
- Strip newlines from SSH keys before saving
- Translation updates rhbz#1689979
[1-1]
- New version 1
- Translation updates rhbz#1689979
[0.4-1]
- New version 0.4
- Include ability to start lorax-composer rhbz#1708387
[0.3-1]
- New version 0.3
- Add/edit/remove sources
- Remove new line in encrypted password rhbz#1655862
- Resolve issues with changes saved to the workspace
[0.2.1-1]
- New version 0.2.1
- Several fixes to User Account creation dialog
[0.2.0-1]
- New version 0.2.0
- Include ability to add a user to a blueprint rhbz#1655862
[0.1.8-1]
- New version 0.1.8
- Provide visual indication when a blueprint component is a dependency
- Enable Undo to retrieve changes after the Discard Changes action
- Update how blueprint contents are depsolved when contents are added/removed
- Display an error if a component is added that results in a depsolve failure
- Show all versions available for a package
- Provide ability to specify a wildcard version for a package rhbz#1673066
[0.1.7-1]
- New version 0.1.7
Resolves: rhbz#1640184
- Capitalize OpenStack corrently in the image create dialog (anilsson)
- Add AppStream metainfo (mpitt)
- Make cockpit-composer the only package name (mpitt)
- Lots of integration test improvements (henrywangxf)
[0.1.6-1]
- New version 0.1.6
Resolves: rhbz#1640184
- Include spec into release tarball (mpitt)
- Fix a bug in importSanity test. (henrywangxf)
- Add RHEL-X in welder-web test scenarios. (henrywangxf)
- test: Support Cockpit test scenario (mpitt)
- Makefile: Simplify variable defaults (mpitt)
- A big commit to fix random failure on chrome. (henrywangxf)
- Remove inert 'Architecture' field in 'Create Image' dialog (#388) (stefw)
- po: Update from Fedora Zanata (lars)
- Remove ForEach to run two test cases but use two separate cases. If there's
one case failed, I can find it according to case name. (henrywangxf)
- Wait for delete menu action visable before click it. (henrywangxf)
- test: Drop node installation from vm.install (mpitt)
- Don't clean bots/ directory for VM preparation (mpitt)
- Two improvements: (henrywangxf)
- Go to view blueprint page by clicking blueprint name link instead of by URL.
That helps improving case stability. (henrywangxf)
- Move sed to test/vm.install from test/run because developers do not normally
use test/run to trigger tests. (henrywangxf)
- test: Only install node if it isn't already available (mpitt)
- Makefile: bots is not a phony target (mpitt)
[0.1.5-1]
- New version 0.1.5
Related: rhbz#1613058
- Found a code coverage bug and fix it. (henrywangxf)
- Update README.md to support Cockpit CI. (henrywangxf)
- Updates Create Image modal to not have a default image type (jgiardin)
- Add support for Modules during Add/Remove (jgiardin)
- new test: Build mock images and verify download becomes enabled (atodorov)
- Fix flaky issue when running test on chrome (henrywangxf)
- Add selenium debug support. (henrywangxf)
- Creates user-friendly labels to display for image types (jgiardin)
- Compile with c
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | cockpit-composer | 0:45-1.0.1.el8_8 |
| Oracle Linux · 8 | osbuild | 0:81-1.el8 |
| Oracle Linux · 8 | osbuild-composer | 0:75-1.el8 |
| Oracle Linux · 8 | osbuild-composer-core | 0:75-1.el8 |
| Oracle Linux · 8 | osbuild-composer-dnf-json | 0:75-1.el8 |
| Oracle Linux · 8 | osbuild-composer-worker | 0:75-1.el8 |
| Oracle Linux · 8 | osbuild-luks2 | 0:81-1.el8 |
| Oracle Linux · 8 | osbuild-lvm2 | 0:81-1.el8 |
| Oracle Linux · 8 | osbuild-ostree | 0:81-1.el8 |
| Oracle Linux · 8 | osbuild-selinux | 0:81-1.el8 |
| Oracle Linux · 8 | python3-osbuild | 0:81-1.el8 |
| Oracle Linux · 8 | weldr-client | 0:35.9-2.el8 |
Vulnerabilities 5
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
Medium 5.3CVE-2022-41717 Public exploit
Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…
-
Unscored —
Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…