[Apollo] Advisories Statistics light light Login

RLSA-2026:71543

Security Mirrored from RHSA-2026:71543
Issued at: 2026-09-25
Updated at: 2026-09-25

Advisory content derived from Red Hat RHSA-2026:71543, © Red Hat, Inc., used under CC BY 4.0, with modifications.

Synopsis

Important: cockpit-image-builder security update



Description

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.

Security Fix(es):

* fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)

* fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)

* fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)

* fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.



Affected products

Rocky Linux 10 aarch64 Rocky Linux 10 ppc64le Rocky Linux 10 riscv64 Rocky Linux 10 s390x Rocky Linux 10 x86_64

Fixes

2521778 2521779 2521798 2527747

CVEs

CVE-2026-75899 CVE-2026-75975 CVE-2026-76172 CVE-2026-84292

Affected packages

Rocky Linux 10 aarch64 - AppStream

cockpit-image-builder-0:94.4-1.el10_2.noarch.rpm cockpit-image-builder-0:94.4-1.el10_2.src.rpm

Rocky Linux 10 ppc64le - AppStream

cockpit-image-builder-0:94.4-1.el10_2.noarch.rpm cockpit-image-builder-0:94.4-1.el10_2.src.rpm

Rocky Linux 10 riscv64 - AppStream

cockpit-image-builder-0:94.4-1.el10_2.noarch.rpm cockpit-image-builder-0:94.4-1.el10_2.src.rpm

Rocky Linux 10 s390x - AppStream

cockpit-image-builder-0:94.4-1.el10_2.noarch.rpm cockpit-image-builder-0:94.4-1.el10_2.src.rpm

Rocky Linux 10 x86_64 - AppStream

cockpit-image-builder-0:94.4-1.el10_2.noarch.rpm cockpit-image-builder-0:94.4-1.el10_2.src.rpm