Summary
[356.2-1.0.1]
- Storage: Enable btrfs support [Orabug: 37464632]
- Replaced upstream urls in documentation with oracle links [Orabug: 36528753]
- Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
- Remove duplicate reference to server in cockpit [Orabug: 34030494]
- Update documentation links [Orabug: 30271413], [Orabug: 32013095],
[Orabug: 32795691], [Orabug: 34398512], [Orabug: 34742876], [Orabug: 37253273]
- Update spec file for new release
[356.1-1]
- ws: Prevent remote code execution with SSH argument injection (RHEL-158306)
- node: update lodash dependency (RHEL-164067)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | cockpit | 0:356.2-1.0.1.el10_2 |
| Oracle Linux · 10 | cockpit-bridge | 0:356.2-1.0.1.el10_2 |
| Oracle Linux · 10 | cockpit-doc | 0:356.2-1.0.1.el10_2 |
| Oracle Linux · 10 | cockpit-packagekit | 0:356.2-1.0.1.el10_2 |
| Oracle Linux · 10 | cockpit-storaged | 0:356.2-1.0.1.el10_2 |
| Oracle Linux · 10 | cockpit-system | 0:356.2-1.0.1.el10_2 |
| Oracle Linux · 10 | cockpit-ws | 0:356.2-1.0.1.el10_2 |
| Oracle Linux · 10 | cockpit-ws-selinux | 0:356.2-1.0.1.el10_2 |
Vulnerabilities 1
-
High 8.0CVE-2026-4802 Public exploit
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can injec…