Security update for cockpit SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:0206-1 Final 1 1 2024-07-21T12:01:36Z current 2024-07-21T12:01:36Z 2024-07-21T12:01:36Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for cockpit This update for cockpit fixes the following issues: - new version 320: * pam-ssh-add: Fix insecure killing of session ssh-agent (boo#1226040, CVE-2024-6126) - changes in older versions: * Storage: Btrfs snapshots * Podman: Add image pull action * Files: Bookmark support * webserver: System user changes * Metrics: Grafana setup now prefers Valkey - Invalid json against the storaged manifest boo#1227299 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2024-206 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CNZTH7PKY4BMSDPSUA32JS3BZQRTKTGF/ E-Mail link for openSUSE-SU-2024:0206-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1226040 SUSE Bug 1226040 https://bugzilla.suse.com/1227299 SUSE Bug 1227299 https://www.suse.com/security/cve/CVE-2024-6126/ SUSE CVE CVE-2024-6126 page SUSE Package Hub 15 SP6 openSUSE Leap 15.6 cockpit-320-bp156.2.6.3 cockpit-bridge-320-bp156.2.6.3 cockpit-devel-320-bp156.2.6.3 cockpit-doc-320-bp156.2.6.3 cockpit-kdump-320-bp156.2.6.3 cockpit-networkmanager-320-bp156.2.6.3 cockpit-packagekit-320-bp156.2.6.3 cockpit-pcp-320-bp156.2.6.3 cockpit-selinux-320-bp156.2.6.3 cockpit-storaged-320-bp156.2.6.3 cockpit-system-320-bp156.2.6.3 cockpit-ws-320-bp156.2.6.3 cockpit-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-bridge-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-devel-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-doc-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-kdump-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-networkmanager-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-packagekit-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-pcp-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-selinux-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-storaged-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-system-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-ws-320-bp156.2.6.3 as a component of SUSE Package Hub 15 SP6 cockpit-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-bridge-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-devel-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-doc-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-kdump-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-networkmanager-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-packagekit-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-pcp-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-selinux-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-storaged-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-system-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 cockpit-ws-320-bp156.2.6.3 as a component of openSUSE Leap 15.6 A flaw was found in the cockpit package. This flaw allows an authenticated user to kill any process when enabling the pam_env's user_readenv option, which leads to a denial of service (DoS) attack. CVE-2024-6126 SUSE Package Hub 15 SP6:cockpit-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-bridge-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-devel-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-doc-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-kdump-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-networkmanager-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-packagekit-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-pcp-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-selinux-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-storaged-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-system-320-bp156.2.6.3 SUSE Package Hub 15 SP6:cockpit-ws-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-bridge-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-devel-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-doc-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-kdump-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-networkmanager-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-packagekit-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-pcp-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-selinux-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-storaged-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-system-320-bp156.2.6.3 openSUSE Leap 15.6:cockpit-ws-320-bp156.2.6.3 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CNZTH7PKY4BMSDPSUA32JS3BZQRTKTGF/ https://www.suse.com/security/cve/CVE-2024-6126.html CVE-2024-6126 https://bugzilla.suse.com/1226040 SUSE Bug 1226040