SUSE-SU-2026:22770-1: critical: Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions

SLE-UPDATES null at suse.de
Wed Jul 22 20:30:45 UTC 2026 

# Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-
podman, cockpit-repos, cockpit-subscriptions

Announcement ID: SUSE-SU-2026:22770-1  
Release Date: 2026-07-21T16:05:47Z  
Rating: critical  
References:

  * bsc#1236149
  * bsc#1257033
  * bsc#1257325
  * bsc#1257698
  * bsc#1257836
  * bsc#1257838
  * bsc#1257840
  * bsc#1258040
  * bsc#1258637
  * bsc#1258640
  * bsc#1258641
  * bsc#1259010
  * bsc#1259013
  * bsc#1259015
  * bsc#1259210
  * bsc#1259774
  * bsc#1261829
  * jsc#PED-15706
  * jsc#PED-15820

  
Cross-References:

  * CVE-2025-13465
  * CVE-2026-25547
  * CVE-2026-26996
  * CVE-2026-27904
  * CVE-2026-4631
  * CVE-2026-4802

  
CVSS scores:

  * CVE-2025-13465 ( SUSE ):  8.8
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-13465 ( SUSE ):  8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
  * CVE-2025-13465 ( NVD ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2025-13465 ( NVD ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  * CVE-2025-13465 ( NVD ):  8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
  * CVE-2026-25547 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-25547 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-25547 ( NVD ):  9.2
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-26996 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-26996 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-26996 ( NVD ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-26996 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-27904 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-27904 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-27904 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-4631 ( SUSE ):  9.3
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-4631 ( SUSE ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-4631 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-4631 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-4802 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-4802 ( SUSE ):  8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-4802 ( NVD ):  8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-4802 ( NVD ):  8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

  
Affected Products:

  * SUSE Linux Micro 6.2

  
  
An update that solves six vulnerabilities, contains two features and has 11
fixes can now be installed.

## Description:

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman,
cockpit-repos, cockpit-subscriptions fixes the following issues:

Security issues fixed:

  * CVE-2025-13465: lodash: prototype pollution in the _.unset and_.omit
    functions can lead to deletion of methods from global prototypes
    (bsc#1257325).
  * CVE-2026-4631: SSH command-line argument injection can lead to
    unauthenticated remote code execution (bsc#1261829).
  * CVE-2026-25547: brace-expansion: unbounded brace range expansion can lead to
    excessive CPU and memory consumption and may crash a Node.js process
    (bsc#1257836 bsc#1257838 bsc#1257840).
  * CVE-2026-26996: minimatch: ReDoS when glob pattern contains many consecutive
    wildcards followed by a literal character that doesn't appear in the test
    string (bsc#1258637 bsc#1258640 bsc#1258641).
  * CVE-2026-27904: minimatch: nested *() extglobs can lead to regular
    expressions with exponential backtracking complexity and a ReDoS
    (bsc#1259010 bsc#1259013 bsc#1259015).

Non security issues fixed:

  * cockpit webUI - 'Software updates - install all updates' got an unexpected
    internal error (bsc#1259210).
  * cockpit-machines does not work out of the box, missing libvirt daemon
    (bsc#1236149).

Changes for cockpit:

  * Update to 364.

  * Update to 361 (jsc#PED-15706/jsc#CPT-183):

  * Remove all "Mount" actions in Anaconda mode

  * Dependency updates

  * Update to 360:

  * ws: be more explicit when handling hostnames on cli
    bsc#1261829/CVE-2026-4631
  * ws: support loading a custom login page

  * Update to 358:

  * Networking: Add Wi-Fi support

  * Cockpit Client updated to GTK 4
  * Bugfixes and translation updates

  * Update to 357:

  * lib: Use browser context menu on shift

  * bridge: support Python 3.14 on old kernels (RHEL 8)

  * Update to 356:

  * systemd: Allow editing timers created by Cockpit

  * Convert license headers to SPDX format

  * Update to 355:

  * ws: Remove obsolete pam_cockpit_cert module

  * shell: add StartTransientUnit as a sudo alternative

Changes for cockpit-machines:

  * Update to 354.

  * Update to 352:

  * Improvements to the "Add disk" and "Create Volume" dialogs.

  * Update suse_version requirement to function with the planned bump
    (jsc#PED-15820).

  * Drop explict dependency on libvirt (bsc#1258040, bsc#1236149).

  * Update to 348:

  * Translation updates

  * Convert license headers to SPDX format
  * Now requires cockpit-devel 356 due to the replacement of xterm/addon-canvas
    with xterm/addon-webgl

  * Update to 347:

  * Bug fixes and translation updates

  * Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-packages:

  * Update to version 5:

  * Support transactional systems

  * Improve error/success messages
  * Translation updates

  * Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-podman:

  * Update to 128.
  * Fix esbuild for ppc64le (bsc#1257698).

Changes for cockpit-repos:

  * Update to 4.8.
  * Patch esbuild to use native runtime on ppc64 (bsc#1257698).

Changes for cockpit-subscriptions:

  * Update to version 16.2 (bsc#1257033).
  * Patch esbuild to use native runtime on ppc64 (bsc#1257698).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Micro 6.2  
    zypper in -t patch SUSE-SL-Micro-6.2-1309=1

## Package List:

  * SUSE Linux Micro 6.2 (noarch)
    * cockpit-podman-128-160000.1.1
    * cockpit-networkmanager-364-160000.1.1
    * cockpit-machines-354-160000.1.1
    * cockpit-firewalld-364-160000.1.1
    * cockpit-system-364-160000.1.1
    * cockpit-kdump-364-160000.1.1
    * cockpit-selinux-364-160000.1.1
    * cockpit-repos-4.8-160000.1.1
    * cockpit-subscriptions-16.2-160000.1.1
    * cockpit-bridge-364-160000.1.1
    * cockpit-storaged-364-160000.1.1
  * SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
    * cockpit-ws-debuginfo-364-160000.1.1
    * cockpit-debugsource-364-160000.1.1
    * cockpit-364-160000.1.1
    * cockpit-ws-selinux-364-160000.1.1
    * cockpit-ws-364-160000.1.1

## References:

  * https://www.suse.com/security/cve/CVE-2025-13465.html
  * https://www.suse.com/security/cve/CVE-2026-25547.html
  * https://www.suse.com/security/cve/CVE-2026-26996.html
  * https://www.suse.com/security/cve/CVE-2026-27904.html
  * https://www.suse.com/security/cve/CVE-2026-4631.html
  * https://www.suse.com/security/cve/CVE-2026-4802.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1236149
  * https://bugzilla.suse.com/show_bug.cgi?id=1257033
  * https://bugzilla.suse.com/show_bug.cgi?id=1257325
  * https://bugzilla.suse.com/show_bug.cgi?id=1257698
  * https://bugzilla.suse.com/show_bug.cgi?id=1257836
  * https://bugzilla.suse.com/show_bug.cgi?id=1257838
  * https://bugzilla.suse.com/show_bug.cgi?id=1257840
  * https://bugzilla.suse.com/show_bug.cgi?id=1258040
  * https://bugzilla.suse.com/show_bug.cgi?id=1258637
  * https://bugzilla.suse.com/show_bug.cgi?id=1258640
  * https://bugzilla.suse.com/show_bug.cgi?id=1258641
  * https://bugzilla.suse.com/show_bug.cgi?id=1259010
  * https://bugzilla.suse.com/show_bug.cgi?id=1259013
  * https://bugzilla.suse.com/show_bug.cgi?id=1259015
  * https://bugzilla.suse.com/show_bug.cgi?id=1259210
  * https://bugzilla.suse.com/show_bug.cgi?id=1259774
  * https://bugzilla.suse.com/show_bug.cgi?id=1261829
  * https://jira.suse.com/browse/PED-15706
  * https://jira.suse.com/browse/PED-15820

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260722/57ea8d34/attachment.htm>

More information about the sle-updates mailing list