ALSA-2026:71543
See a problem?- Import Source
- https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2026:71543.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALSA-2026:71543
- Related
- Published
- 2026-09-24T00:00:00Z
- Modified
- 2026-09-28T20:45:03Z
- Summary
- Important: cockpit-image-builder security update
- Details
-
The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.
Security Fix(es):
- fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding (CVE-2026-75899)
- fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization (CVE-2026-75975)
- fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects (CVE-2026-76172)
- fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization (CVE-2026-84292)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- References
-
- https://access.redhat.com/errata/RHSA-2026:71543
- https://access.redhat.com/security/cve/CVE-2026-75899
- https://access.redhat.com/security/cve/CVE-2026-75975
- https://access.redhat.com/security/cve/CVE-2026-76172
- https://access.redhat.com/security/cve/CVE-2026-84292
- https://bugzilla.redhat.com/2521778
- https://bugzilla.redhat.com/2521779
- https://bugzilla.redhat.com/2521798
- https://bugzilla.redhat.com/2527747
- https://errata.almalinux.org/10/ALSA-2026-71543.html