Critical Security Flaws in cockpit-image-builder: Important Update Required
Summary
ALSA-2026:71543: Important: cockpit-image-builder security update. Affects cockpit-image-builder versions < 94.4-1.el10_2. Fixed in 94.4-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cockpit-image-builder is a tool that generates custom images for deploying systems or uploading to the cloud. It serves as a frontend for osbuild within the Cockpit interface, allowing users to create and manage images efficiently. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities stem from issues within the fast-uri library used by cockpit-image-builder. These include Server-Side Request Forgery (SSRF) vulnerabilities due to repeated hostname percent-decoding, malformed IPv6 normalization, URI parsing flaws, and authority injection via unvalidated port serialization. These vulnerabilities could allow attackers to manipulate requests and potentially gain unauthorized access to sensitive information or systems.
How To Fix
Minimum fixed version
94.4-1.el10_2
This is the first release that contains the fix.
sudo dnf update cockpit-image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for these vulnerabilities. The best course of action is to apply the security update as soon as it is available.
Conclusion
The identified vulnerabilities in cockpit-image-builder pose significant security risks that could be exploited by attackers. It is imperative to update to the latest patched version to safeguard your systems. Regular monitoring and timely updates are essential in maintaining security.
See every vulnerability recorded for cockpit-image-builder →
FAQ
cockpit-image-builder is a tool that helps users create custom images for system deployment or cloud uploads, integrating with the Cockpit interface.
The vulnerabilities could allow attackers to perform Server-Side Request Forgery, potentially leading to unauthorized access to sensitive data or systems.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available. You should update to version 94.4-1.el10_2 of cockpit-image-builder to mitigate the vulnerabilities.
While there are no specific workarounds, it is crucial to prioritize the update to minimize security risks. Monitor your systems closely until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for cockpit-image-builder.
