{"schema_version":"1.7.5","id":"openSUSE-SU-2026:21399-1","published":"2026-07-21T15:45:48Z","modified":"2026-07-24T18:24:25.081526809Z","related":["CVE-2025-13465","CVE-2026-25547","CVE-2026-26996","CVE-2026-27904","CVE-2026-4631","CVE-2026-4802"],"upstream":["CVE-2025-13465","CVE-2026-25547","CVE-2026-26996","CVE-2026-27904","CVE-2026-4631","CVE-2026-4802"],"summary":"Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions","details":"This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-13465: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from\n  global prototypes (bsc#1257325).\n- CVE-2026-4631: SSH command-line argument injection can lead to unauthenticated remote code execution (bsc#1261829).\n- CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and\n  may crash a Node.js process (bsc#1257836 bsc#1257838 bsc#1257840).\n- CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive wildcards followed by a literal character\n  that doesn't appear in the test string (bsc#1258637 bsc#1258640 bsc#1258641).\n- CVE-2026-27904: minimatch: nested *() extglobs can lead to regular expressions with exponential backtracking\n  complexity and a ReDoS (bsc#1259010 bsc#1259013 bsc#1259015).\n\nNon security issues fixed:\n\n- cockpit webUI - 'Software updates - install all updates' got an unexpected internal error (bsc#1259210).\n- cockpit-machines does not work out of the box, missing libvirt daemon (bsc#1236149).\n\nChanges for cockpit:\n\n- Update to 364.\n\n- Update to 361 (jsc#PED-15706/jsc#CPT-183):\n\n * Remove all \"Mount\" actions in Anaconda mode\n * Dependency updates\n\n- Update to 360:\n * ws: be more explicit when handling hostnames on cli bsc#1261829/CVE-2026-4631\n * ws: support loading a custom login page\n\n- Update to 358:\n\n * Networking: Add Wi-Fi support\n * Cockpit Client updated to GTK 4\n * Bugfixes and translation updates\n\n- Update to 357:\n\n * lib: Use browser context menu on shift\n * bridge: support Python 3.14 on old kernels (RHEL 8)\n\n- Update to 356:\n\n * systemd: Allow editing timers created by Cockpit\n * Convert license headers to SPDX format\n\n- Update to 355:\n\n * ws: Remove obsolete pam_cockpit_cert module\n * shell: add StartTransientUnit as a sudo alternative\n\nChanges for cockpit-machines:\n\n- Update to 354.\n\n- Update to 352:\n\n - Improvements to the \"Add disk\" and \"Create Volume\" dialogs.\n\n- Update suse_version requirement to function with the planned bump (jsc#PED-15820).\n- Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).\n\n- Update to 348:\n\n * Translation updates\n * Convert license headers to SPDX format\n * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas with xterm/addon-webgl\n\n- Update to 347:\n * Bug fixes and translation updates\n\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-packages:\n\n- Update to version 5:\n\n * Support transactional systems\n * Improve error/success messages\n * Translation updates\n\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-podman:\n\n- Update to 128.\n- Fix esbuild for ppc64le (bsc#1257698).\n\nChanges for cockpit-repos:\n\n- Update to 4.8.\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n\nChanges for cockpit-subscriptions:\n\n- Update to version 16.2 (bsc#1257033).\n- Patch esbuild to use native runtime on ppc64 (bsc#1257698).\n","affected":[{"package":{"name":"cockpit","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cockpit&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"364-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"cockpit":"364-160000.1.1","cockpit-bridge":"364-160000.1.1","cockpit-devel":"364-160000.1.1","cockpit-doc":"364-160000.1.1","cockpit-firewalld":"364-160000.1.1","cockpit-kdump":"364-160000.1.1","cockpit-machines":"354-160000.1.1","cockpit-networkmanager":"364-160000.1.1","cockpit-packagekit":"364-160000.1.1","cockpit-packages":"5-160000.1.1","cockpit-podman":"128-160000.1.1","cockpit-repos":"4.8-160000.1.1","cockpit-selinux":"364-160000.1.1","cockpit-storaged":"364-160000.1.1","cockpit-subscriptions":"16.2-160000.1.1","cockpit-system":"364-160000.1.1","cockpit-ws":"364-160000.1.1","cockpit-ws-selinux":"364-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21399-1.json"}},{"package":{"name":"cockpit-machines","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cockpit-machines&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"354-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"cockpit":"364-160000.1.1","cockpit-bridge":"364-160000.1.1","cockpit-devel":"364-160000.1.1","cockpit-doc":"364-160000.1.1","cockpit-firewalld":"364-160000.1.1","cockpit-kdump":"364-160000.1.1","cockpit-machines":"354-160000.1.1","cockpit-networkmanager":"364-160000.1.1","cockpit-packagekit":"364-160000.1.1","cockpit-packages":"5-160000.1.1","cockpit-podman":"128-160000.1.1","cockpit-repos":"4.8-160000.1.1","cockpit-selinux":"364-160000.1.1","cockpit-storaged":"364-160000.1.1","cockpit-subscriptions":"16.2-160000.1.1","cockpit-system":"364-160000.1.1","cockpit-ws":"364-160000.1.1","cockpit-ws-selinux":"364-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21399-1.json"}},{"package":{"name":"cockpit-packages","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cockpit-packages&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"cockpit":"364-160000.1.1","cockpit-bridge":"364-160000.1.1","cockpit-devel":"364-160000.1.1","cockpit-doc":"364-160000.1.1","cockpit-firewalld":"364-160000.1.1","cockpit-kdump":"364-160000.1.1","cockpit-machines":"354-160000.1.1","cockpit-networkmanager":"364-160000.1.1","cockpit-packagekit":"364-160000.1.1","cockpit-packages":"5-160000.1.1","cockpit-podman":"128-160000.1.1","cockpit-repos":"4.8-160000.1.1","cockpit-selinux":"364-160000.1.1","cockpit-storaged":"364-160000.1.1","cockpit-subscriptions":"16.2-160000.1.1","cockpit-system":"364-160000.1.1","cockpit-ws":"364-160000.1.1","cockpit-ws-selinux":"364-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21399-1.json"}},{"package":{"name":"cockpit-podman","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cockpit-podman&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"cockpit":"364-160000.1.1","cockpit-bridge":"364-160000.1.1","cockpit-devel":"364-160000.1.1","cockpit-doc":"364-160000.1.1","cockpit-firewalld":"364-160000.1.1","cockpit-kdump":"364-160000.1.1","cockpit-machines":"354-160000.1.1","cockpit-networkmanager":"364-160000.1.1","cockpit-packagekit":"364-160000.1.1","cockpit-packages":"5-160000.1.1","cockpit-podman":"128-160000.1.1","cockpit-repos":"4.8-160000.1.1","cockpit-selinux":"364-160000.1.1","cockpit-storaged":"364-160000.1.1","cockpit-subscriptions":"16.2-160000.1.1","cockpit-system":"364-160000.1.1","cockpit-ws":"364-160000.1.1","cockpit-ws-selinux":"364-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21399-1.json"}},{"package":{"name":"cockpit-repos","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cockpit-repos&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"cockpit":"364-160000.1.1","cockpit-bridge":"364-160000.1.1","cockpit-devel":"364-160000.1.1","cockpit-doc":"364-160000.1.1","cockpit-firewalld":"364-160000.1.1","cockpit-kdump":"364-160000.1.1","cockpit-machines":"354-160000.1.1","cockpit-networkmanager":"364-160000.1.1","cockpit-packagekit":"364-160000.1.1","cockpit-packages":"5-160000.1.1","cockpit-podman":"128-160000.1.1","cockpit-repos":"4.8-160000.1.1","cockpit-selinux":"364-160000.1.1","cockpit-storaged":"364-160000.1.1","cockpit-subscriptions":"16.2-160000.1.1","cockpit-system":"364-160000.1.1","cockpit-ws":"364-160000.1.1","cockpit-ws-selinux":"364-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21399-1.json"}},{"package":{"name":"cockpit-subscriptions","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/cockpit-subscriptions&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2-160000.1.1"}]}],"ecosystem_specific":{"binaries":[{"cockpit":"364-160000.1.1","cockpit-bridge":"364-160000.1.1","cockpit-devel":"364-160000.1.1","cockpit-doc":"364-160000.1.1","cockpit-firewalld":"364-160000.1.1","cockpit-kdump":"364-160000.1.1","cockpit-machines":"354-160000.1.1","cockpit-networkmanager":"364-160000.1.1","cockpit-packagekit":"364-160000.1.1","cockpit-packages":"5-160000.1.1","cockpit-podman":"128-160000.1.1","cockpit-repos":"4.8-160000.1.1","cockpit-selinux":"364-160000.1.1","cockpit-storaged":"364-160000.1.1","cockpit-subscriptions":"16.2-160000.1.1","cockpit-system":"364-160000.1.1","cockpit-ws":"364-160000.1.1","cockpit-ws-selinux":"364-160000.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21399-1.json"}}],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236149"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257033"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257325"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257698"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257836"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257838"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257840"},{"type":"REPORT","url":"https://bugzilla.suse.com/1258040"},{"type":"REPORT","url":"https://bugzilla.suse.com/1258637"},{"type":"REPORT","url":"https://bugzilla.suse.com/1258640"},{"type":"REPORT","url":"https://bugzilla.suse.com/1258641"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259010"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259013"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259015"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259210"},{"type":"REPORT","url":"https://bugzilla.suse.com/1259774"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261829"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-13465"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25547"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-26996"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27904"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-4631"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-4802"}]}