SUSE-RU-2024:0775-1: Recommended update for cockpit

Q: Which systems are in scope for this update?

The update applies to SUSE Linux Enterprise Micro 5.5 on aarch64, s390x, and x86_64. Affected packages include cockpit, cockpit-bridge, cockpit-ws, and their debug or debuginfo packages.

Q: Does this advisory identify a specific security vulnerability or exploitation method?

No. The provided information describes libssh compatibility fixes and removal of a duplicate SELinux file context for /usr/bin/cockpit-bridge, but does not identify a CVE, attack vector, or exploitation prerequisites.

Q: How can I determine whether cockpit-bridge is relevant in my environment?

Check whether cockpit-bridge is installed on a SUSE Linux Enterprise Micro 5.5 system. The advisory specifically changes the SELinux file-context handling for /usr/bin/cockpit-bridge.

Published Mar 6, 2024

Updated

This update for cockpit fixes the following issues: backport compatibility fixes for libssh (bsc#1220385) Remove SELinux file context for /usr/bin/cockpit-bridge, this is already defined in the main selinux-policy package (bsc#1220385).

Affected Software

13 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)

Any of the following

suse/cockpit-debugsource<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-debuginfo<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-bridge<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-bridge-debuginfo<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-ws<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-ws-debuginfo<298-150500.3.3.1

298-150500.3.3.1

All of the following

SUSE SUSE Linux Enterprise Micro 5.5 (noarch)

Any of the following

suse/cockpit-selinux<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-networkmanager<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-system<298-150500.3.3.1

298-150500.3.3.1

suse/cockpit-storaged<298-150500.3.3.1

298-150500.3.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/cockpit-debugsource to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-debuginfo to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-bridge to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-bridge-debuginfo to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-ws to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-ws-debuginfo to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-selinux to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-networkmanager to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-system to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade suse/cockpit-storaged to a version that resolves this vulnerability.
Fixed in 298-150500.3.3.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Micro-5.5-2024-775=1
Configuration
Remove the SELinux file context for /usr/bin/cockpit-bridge, since it is already defined in the main selinux-policy package.
SELinux file context for /usr/bin/cockpit-bridge = removed

Event History

Mar 6, 2024

Advisory Published

via SUSE·08:30 AM

Frequently Asked Questions

Which systems are in scope for this update?

The update applies to SUSE Linux Enterprise Micro 5.5 on aarch64, s390x, and x86_64. Affected packages include cockpit, cockpit-bridge, cockpit-ws, and their debug or debuginfo packages.

Does this advisory identify a specific security vulnerability or exploitation method?

No. The provided information describes libssh compatibility fixes and removal of a duplicate SELinux file context for /usr/bin/cockpit-bridge, but does not identify a CVE, attack vector, or exploitation prerequisites.

How can I determine whether cockpit-bridge is relevant in my environment?

Check whether cockpit-bridge is installed on a SUSE Linux Enterprise Micro 5.5 system. The advisory specifically changes the SELinux file-context handling for /usr/bin/cockpit-bridge.

SUSE-RU-2024:0775-1: Recommended update for cockpit

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are in scope for this update?

Does this advisory identify a specific security vulnerability or exploitation method?

How can I determine whether cockpit-bridge is relevant in my environment?

Company

Resources

Contact

Frequently Asked Questions

Which systems are in scope for this update?

Does this advisory identify a specific security vulnerability or exploitation method?

How can I determine whether cockpit-bridge is relevant in my environment?