Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions
This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:
Security issues fixed:
- CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from
global prototypes (bsc#1257325).
- CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).
- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and
may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).
- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character
that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).
- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking
complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).
Non security issues fixed:
- cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).
- cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).
Changes for cockpit:
- Update to 364.
- Update to 361 (jsc#PED-15706/jsc#CPT-183):
- Remove all "Mount" actions in Anaconda mode
- Dependency updates
- Update to 360:
- ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631
- ws: support loading a custom login page
- Update to 358:
- Networking: Add Wi-Fi support
- Cockpit Client updated to GTK 4
- Bugfixes and translation updates
- Update to 357:
- lib: Use browser context menu on shift
- bridge: support Python 3.14 on old kernels (RHEL 8)
- Update to 356:
- systemd: Allow editing timers created by Cockpit
- Convert license headers to SPDX format
- Update to 355:
- ws: Remove obsolete pam_cockpit_cert module
- shell: add StartTransientUnit as a sudo alternative
Changes for cockpit-machines:
- Update to 354.
- Update to 352:
- Improvements to the "Add disk" and "Create Volume" dialogs.
- Update suse_version requirement to function with the planned bump (jsc#PED-15820).
- Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).
- Update to 348:
- Translation updates
- Convert license headers to SPDX format
- Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl
- Update to 347:
- Bug fixes and translation updates
- Fix esbuild for ppc64le (bsc#1257698).
Changes for cockpit-packages:
- Update to version 5:
- Support transactional systems
- Improve error/success messages
- Translation updates
- Patch esbuild to use native runtime on ppc64 (bsc#1257698).
Changes for cockpit-podman:
- Update to 128.
- Fix esbuild for ppc64le (bsc#1257698).
Changes for cockpit-repos:
- Update to 4.8.
- Patch esbuild to use native runtime on ppc64 (bsc#1257698).
Changes for cockpit-subscriptions:
- Update to version 16.2 (bsc#1257033).
- Patch esbuild to use native runtime on ppc64 (bsc#1257698).
