Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21208-1

Опубликовано: 02 июл. 2026
Источник: suse-cvrf

Описание

Security update for cockpit

This update for cockpit fixes the following issue

  • CVE-2026-4802: remote command execution via unsanitized user-controlled parameters within crafted links in system logs UI (bsc#1265040).

Список пакетов

openSUSE Leap 16.0
cockpit-354-160000.4.1
cockpit-bridge-354-160000.4.1
cockpit-devel-354-160000.4.1
cockpit-doc-354-160000.4.1
cockpit-firewalld-354-160000.4.1
cockpit-kdump-354-160000.4.1
cockpit-networkmanager-354-160000.4.1
cockpit-packagekit-354-160000.4.1
cockpit-selinux-354-160000.4.1
cockpit-storaged-354-160000.4.1
cockpit-system-354-160000.4.1
cockpit-ws-354-160000.4.1
cockpit-ws-selinux-354-160000.4.1

Ссылки

Описание

A flaw was found in Cockpit. This vulnerability allows a remote attacker to achieve arbitrary command execution on the host by exploiting unsanitized user-controlled parameters within crafted links in the system logs user interface (UI). An attacker can inject shell metacharacters and command substitutions into these parameters, leading to the execution of arbitrary shell commands on the affected system. This could result in a complete system compromise.

Затронутые продукты
openSUSE Leap 16.0:cockpit-354-160000.4.1
openSUSE Leap 16.0:cockpit-bridge-354-160000.4.1
openSUSE Leap 16.0:cockpit-devel-354-160000.4.1
openSUSE Leap 16.0:cockpit-doc-354-160000.4.1
Ссылки