Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2024-9325

Опубликовано: 14 нояб. 2024
Источник: oracle-oval
Платформа: Oracle Linux 9

Описание

ELSA-2024-9325: cockpit security update (LOW)

[323.1-1.0.1]

  • Replaced upstream urls in documentation with oracle links [Orabug: 36528753]
  • Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
  • Remove duplicate reference to server in cockpit [Orabug: 34030494]
  • Update documentation links [Orabug: 30271413], [Orabug: 32013095], [Orabug: 32795691], [Orabug: 34398512], [Orabug: 34742876], [Orabug: 37253273]
  • Update spec file for new release

[323.1]

  • Remove recommends on subscription-manager-cockpit if applicable

[323-1]

  • metrics: Install valkey instead of redis on RHEL/CentOS 10
  • login: Prevent multiple logins in a single browser session
  • Update documentation links

[322-1]

  • shell: Deprecate host switcher

[321-2]

[321-1]

  • Bug fixes and performance improvements

[320-1]

  • pam-ssh-add: Fix insecure killing of session ssh-agent [CVE-2024-6126]
  • sosreport: Read report directory from sos config (fix page on Debian/Ubuntu)

[319-1]

  • List btrfs snapshots in subvolume detail view

[318-2]

  • Rebuilt for Python 3.13

[318-1]

  • Storage: Extra confirmation before deleting non-empty partitions in Anaconda's Web UI
  • Discontinue Intel 32-bit support in Fedora, CentOS, and RHEL
  • cockpit.js: Get user primary group ID

[317-2]

  • Rebuilt for Python 3.13

[317-1]

  • webserver: System user changes
  • metrics: Prefer valkey over redis on Fedora

[316-1]

  • cockpit.js API: Fix format_bytes() units

[315-1]

  • systemd: Check proper ssh service unit on Debian/Ubuntu
  • Translation updates

[314-1]

  • Diagnostic reports: Fix command injection vulnerability with crafted report names
  • Storage: Improvements to read-only encrypted filesystems

[313-1]

  • assorted bug fixes and improvements

[312-1]

  • Accounts: support lastlog2 and make the page faster
  • Storage: Various Anaconda mode fixes
  • Fix package build if cockpit-bridge package is installed

[311.1-1]

  • Update documentation links to RHEL 9 (RHEL-3954)
  • Storage: Various bug fixes

[311-1]

  • Bug fixes and stability improvements

[310.2-1]

  • selinux: Cover migration to /run
  • ws: Handle HEAD requests correctly, for curl 8.6.0

[310.1-1]

  • bridge: Fix race condition/crash in file watching channels

[310-1]

  • Storage: support for btrfs
  • Storage: improved support for swap

[309-3]

[309-2]

[309-1]

  • Storage: Introduce btrfs support

[308-1]

  • Fix connecting to remote hosts with OpenSSH 0.9.6

[307-1]

  • Storage redesign

[306-1]

  • Kdump: Add Ansible/shell automation

[305-1]

  • Performance and stability improvements

[304-1] Storage: Support for RAID layouts with LVM2

[303-2]

  • Rebuild for untagged selinux-policy (cockpit-ws dep)

[303-1]

  • Apps: Warn if appstream data package is missing
  • Shell: Redesign untrusted 'add host' dialog

[302-1]

  • Storage: Partitions can be resized
  • many bug fixes

[301-1]

  • WireGuard support
  • Metrics: link to network interface details

[300-1]

  • Celebrating the Nurnberg life release!
  • Storage: Support for growing block devices of a Stratis pool

[299-1]

  • Kdump: Show location of kdump to verify the successful configuration test
  • Storage: Support for no-overprovisioning with Stratis
  • Storage: Cockpit can now add caches to encrypted Stratis pools

[297-1]

  • users: allow administrators to change the user shell
  • tools: Enable Python bridge on Fedora 38

[296-2]

[296-1]

  • Performance and stability improvements

[295-2]

  • Rebuilt for Python 3.12

[295-1]

  • Cockpit Client can now connect to servers without Cockpit installed

[294.1-2]

  • Rebuilt for Python 3.12

[294.1-1]

  • Multiple major fixes for the 'remote python bridge' use case

[294-2]

  • Rebuilt for Python 3.12

[294-1]

  • Introduce Python bridge on Fedora Rawhide and Debian unstable

[293-1]

  • Tests and code quality improvements

[292-1]

  • Metrics: Add disk IO per service
  • Several right-to-left language fixes

[291-1]

  • Update to PatternFly 5 Alpha

[290-1]

  • Login page: Add autocomplete tags
  • webserver: Disallow direct URL logins with LoginTo=false

[289-1]

  • Metrics: Indicate high usage and use colorblind-friendly colors
  • Accounts: Improve password validation

[288.1-1]

  • Fix broken 'SELinux' menu entry

[288-1]

  • Accounts: Show shell and home directory on detail page
  • Accounts: Custom user ID during account creation
  • Overview: Support additional timeservers with chronyd
  • Metrics: Show longer time span by default
  • Storage: Mounting filesystems at boot time
  • Services: Units need to be re-pinned
  • API removal: Remove cockpit.dbus.publish() and .meta()
  • Development: Cockpit now supports the esbuild bundler

[287-1]

  • Metrics: Column visiblity
  • Services: Pinned units need to be re-done

[286-1]

  • Metrics page: control visibility of the resource usage graphs

[285-1]

  • Cryptographic subpolicies support
  • users: Group creation and filtering support

[284-1]

  • Services: Show logs for user units
  • Storage: Set up a system to use NBDE

[283-2]

[283-1]

  • Services: Create timer to run every minute

[282-1]

  • Add right-to-left language support
  • Accounts: Redesign and include groups

[281-1]

  • Dark theme switcher

[280.1-1]

  • Exclude kpatch test on RHEL gating

[280-1]

  • tools: Disallow root login by default

Обновленные пакеты

Oracle Linux 9

Oracle Linux aarch64

cockpit

323.1-1.0.1.el9_5

cockpit-bridge

323.1-1.0.1.el9_5

cockpit-doc

323.1-1.0.1.el9_5

cockpit-packagekit

323.1-1.0.1.el9_5

cockpit-pcp

323.1-1.0.1.el9_5

cockpit-storaged

323.1-1.0.1.el9_5

cockpit-system

323.1-1.0.1.el9_5

cockpit-ws

323.1-1.0.1.el9_5

Oracle Linux x86_64

cockpit

323.1-1.0.1.el9_5

cockpit-bridge

323.1-1.0.1.el9_5

cockpit-doc

323.1-1.0.1.el9_5

cockpit-packagekit

323.1-1.0.1.el9_5

cockpit-pcp

323.1-1.0.1.el9_5

cockpit-storaged

323.1-1.0.1.el9_5

cockpit-system

323.1-1.0.1.el9_5

cockpit-ws

323.1-1.0.1.el9_5

Связанные CVE

Связанные уязвимости

CVSS3: 3.2
ubuntu
около 1 года назад

A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.

CVSS3: 3.2
redhat
около 1 года назад

A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.

CVSS3: 3.2
nvd
около 1 года назад

A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack.

CVSS3: 3.2
debian
около 1 года назад

A flaw was found in the cockpit package. This flaw allows an authentic ...

suse-cvrf
около 1 года назад

Security update for cockpit