Summary
[348.1-1.0.1]
- Apply the patch for upstream reference [Orabug: 39248919]
- Replace upstream references [Orabug: 34340088]
[348.1-1]
- CVE-2026-92768 (RHEL-263127)
- CVE-2026-92747 (RHEL-263114)
- CVE-2026-92745 (RHEL-263111)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | cockpit-machines | 0:348.1-1.0.1.el9_8 |
Vulnerabilities 3
-
Medium 5.5
Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments
A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-…
-
Medium 5.0
Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments
A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-lin…
-
Medium 5.0
Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list
A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `insta…