Summary
[344-2.0.1]
- Storage: Enable btrfs support [Orabug: 37464632]
- Replaced upstream urls in documentation with oracle links [Orabug: 36528753]
- Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
- Remove duplicate reference to server in cockpit [Orabug: 34030494]
- Update documentation links [Orabug: 30271413], [Orabug: 32013095],
[Orabug: 32795691], [Orabug: 34398512], [Orabug: 34742876], [Orabug: 37253273]
- Update spec file for new release
[344]
- Remove recommends on subscription-manager-cockpit if applicable
* Fri Mar 27 2026 Jelle van der Waa <jvanderw@redhat.com - 344-2
- ws: be more explicit when handling hostnames on cli (CVE-2026-4631)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | cockpit | 0:344-2.0.1.el9_7 |
| Oracle Linux · 9 | cockpit-bridge | 0:344-2.0.1.el9_7 |
| Oracle Linux · 9 | cockpit-doc | 0:344-2.0.1.el9_7 |
| Oracle Linux · 9 | cockpit-packagekit | 0:344-2.0.1.el9_7 |
| Oracle Linux · 9 | cockpit-storaged | 0:344-2.0.1.el9_7 |
| Oracle Linux · 9 | cockpit-system | 0:344-2.0.1.el9_7 |
| Oracle Linux · 9 | cockpit-ws | 0:344-2.0.1.el9_7 |
| Oracle Linux · 9 | cockpit-ws-selinux | 0:344-2.0.1.el9_7 |
Vulnerabilities 1
-
Critical 9.8
Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login en…