Summary
[310.8-1.0.1]
- Fixed cockpit_ws_t selinux issue for tmpfs [Orabug: 36013589]
- Move update-motd out of cockpit_ws_t context [Orabug: 36013589]
- Update documentation links [Orabug: 34706402]
- Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
- Remove duplicate reference to server in cockpit [Orabug: 33862832]
- Update documentation links [Orabug: 32795691]
- Make documentation links point to Oracle Linux information [Orabug: 30271413] [Orabug: 32013095]
- Fix rendering of hwinfo page on systems with some empty memory slots [Orabug: 32826970]
[310.8]
- Remove recommends on subscription-manager-cockpit if applicable
[310.8-1]
- ws: fix uninitialized read in tls-sniffing code
- ws: tighten up branding path construction
- pkg/systemd: robustify argument quoting [CVE-2026-4802] (RHEL-161386)
[310.7-1]
- shell: Determine session idle time and countdown from clock time (RHEL-171011)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | cockpit | 0:310.8-1.0.1.el8_10 |
| Oracle Linux · 8 | cockpit-bridge | 0:310.8-1.0.1.el8_10 |
| Oracle Linux · 8 | cockpit-doc | 0:310.8-1.0.1.el8_10 |
| Oracle Linux · 8 | cockpit-system | 0:310.8-1.0.1.el8_10 |
| Oracle Linux · 8 | cockpit-ws | 0:310.8-1.0.1.el8_10 |
Vulnerabilities 1
-
High 8.0CVE-2026-4802 Public exploit
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can injec…