Security update for cockpit-machines, cockpit
This update for cockpit-machines, cockpit fixes the following issues: - CVE-2025-13465: Update the lodash dependencie to avoid prototype pollution. (bsc#1257324) Changes in cockpit-machines: - Update to 346 * 346 - Performance improvements - Translation updates * 345 - New virtual machines don't get SPICE graphics anymore - Support for network port forwarding - Bug fixes and translation updates - Update to 344 * 344 - Port forwarding for user session VMs - "Shutdown and restart" action - Faster startup * 343 - Memory usage now shows numbers reported by the guest (RHEL-116731) - Update to 342 * 342 - Bug fixes and translation updates * 341 - Improved UX for Disks and Network interface tables - Bug fixes and translation updates * 340 - Use exclusive VNC connections with "Remote resizing" - Update to 339 * 339 - Serial consoles now keep their content and stay alive - No longer copies qemu.conf values into VM definitions * 338 - Translation and dependency updates - Detachable VNC console - Update to 337 * 337 - Bug fixes and translation updates * 336 - Graphical VNC and serial consoles improvements - Control VNC console resizing and scaling - Bug fixes and translation updates * 335 - Bug fixes and translation updates * 334 - Bug fixes and translation updates Changes in cockpit: - Update to 354 * changes since 351 - 354 * Convert documentation to AsciiDoc * Work around Firefox 146/147 bug (rhbz#2422331) * Bug fixes - 353 * Networking: Suggest prefix length and gateway address * Bug fixes and translation updates - 352 * Shown a warning if the last shutdown/reboot was unclean * Bug fixes and translation updates - Update to 351 * Changes since 349 - 351 * Firewall ports can be deleted individually - 350 * networking: fix renaming of bridges and other groups (RHEL-117883) * bridge: fix OpenSSH_10.2p1 host key detection - Update to 349 * Changes since 346 - 349 * Package manifests: add any test * Bug fixes and translation updates - 348 * Bug fixes and translation updates - 347 * Site-specific branding support - Update to 346 * Changes since 344 - 346 * Support branding Cockpit pages * Storage: Support for Stratis "V2" pools - 345 * Translation and dependency updates * Shorter IPv6 addresses * IPv6 addresses for WireGuard - Update to 344 * Changes since 340 - 344 * Bug fixes and translation updates - 343 * login: Improve error message for unsupported shells * cockpit: Handle file access issues with files in machines.d * Translation updates - 342 * systemd: ensure update() is called at least once for tuned-dialog * Translation updates - 341 * services: show link to podman page for quadlets * Bug fixes and translation updates
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for cockpit-machines, cockpit fixes the following issues: - CVE-2025-13465: Update the lodash dependencie to avoid prototype pollution. (bsc#1257324) Changes in cockpit-machines: - Update to 346 * 346 - Performance improvements - Translation updates * 345 - New virtual machines don't get SPICE graphics anymore - Support for network port forwarding - Bug fixes and translation updates - Update to 344 * 344 - Port forwarding for user session VMs - "Shutdown and restart" action - Faster startup * 343 - Memory usage now shows numbers reported by the guest (RHEL-116731) - Update to 342 * 342 - Bug fixes and translation updates * 341 - Improved UX for Disks and Network interface tables - Bug fixes and translation updates * 340 - Use exclusive VNC connections with "Remote resizing" - Update to 339 * 339 - Serial consoles now keep their content and stay alive - No longer copies qemu.conf values into VM definitions * 338 - Translation and dependency updates - Detachable VNC console - Update to 337 * 337 - Bug fixes and translation updates * 336 - Graphical VNC and serial consoles improvements - Control VNC console resizing and scaling - Bug fixes and translation updates * 335 - Bug fixes and translation updates * 334 - Bug fixes and translation updates Changes in cockpit: - Update to 354 * changes since 351 - 354 * Convert documentation to AsciiDoc * Work around Firefox 146/147 bug (rhbz#2422331) * Bug fixes - 353 * Networking: Suggest prefix length and gateway address * Bug fixes and translation updates - 352 * Shown a warning if the last shutdown/reboot was unclean * Bug fixes and translation updates - Update to 351 * Changes since 349 - 351 * Firewall ports can be deleted individually - 350 * networking: fix renaming of bridges and other groups (RHEL-117883) * bridge: fix OpenSSH_10.2p1 host key detection - Update to 349 * Changes since 346 - 349 * Package manifests: add any test * Bug fixes and translation updates - 348 * Bug fixes and translation updates - 347 * Site-specific branding support - Update to 346 * Changes since 344 - 346 * Support branding Cockpit pages * Storage: Support for Stratis "V2" pools - 345 * Translation and dependency updates * Shorter IPv6 addresses * IPv6 addresses for WireGuard - Update to 344 * Changes since 340 - 344 * Bug fixes and translation updates - 343 * login: Improve error message for unsupported shells * cockpit: Handle file access issues with files in machines.d * Translation updates - 342 * systemd: ensure update() is called at least once for tuned-dialog * Translation updates - 341 * services: show link to podman page for quadlets * Bug fixes and translation updates
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1221342
- https://bugzilla.suse.com/1236149
- https://bugzilla.suse.com/1239759
- https://bugzilla.suse.com/1248250
- https://bugzilla.suse.com/1249828
- https://bugzilla.suse.com/1249830
- https://bugzilla.suse.com/1257324
- https://bugzilla.suse.com/1257325
- https://www.suse.com/security/cve/CVE-2025-13465
- https://www.suse.com/support/update/announcement/2026/suse-su-202620576-1/