9d0695647c
`cockpit-ws` has never protected hostnames from being interpreted as cli
options when passing them to the auth commands (`cockpit-session`,
`cockpit-ssh`, `cockpit.beiboot`). There have been a couple of relevant
changes over the years:
- our move to using cockpit-session via unix socket has removed
exposure to this problem for `cockpit-session`
- our move from `cockpit-ssh` (glib argument parser) to
`cockpit.beiboot` (Python argparse) has unfortunately exposed us to
https://github.com/python/cpython/issues/66623 which means (due to a
strange heuristic) that arguments starting with '-' can be
interpreted as positionals if they also have spaces in them
This gives a way to get a hostname starting with a `-` to ssh (where it
*will* be interpreted as an option) and the following argument (the
python invocation on the remote) will be interpreted as the hostname.
Fortunately, new versions of ssh will reject this hostname. In any
case, we should firm up the code here and add `--` to ensure that it's
definitely interpreted as a hostname by ssh.
For a similar reason add a `--` to the ssh command in `cockpit-ws`.
CVE-2026-4631
|
||
|---|---|---|
| .cockpit-ci | ||
| .fmf | ||
| .github | ||
| containers | ||
| doc | ||
| examples | ||
| LICENSES | ||
| node_modules@1dea97a0e9 | ||
| pkg | ||
| plans | ||
| po | ||
| selinux | ||
| src | ||
| test | ||
| tools | ||
| vendor | ||
| .eslintignore | ||
| .eslintrc.json | ||
| .gitignore | ||
| .gitleaks.toml | ||
| .gitmodules | ||
| .stylelintrc.json | ||
| AUTHORS | ||
| autogen.sh | ||
| build.js | ||
| configure.ac | ||
| files.js | ||
| HACKING.md | ||
| Makefile.am | ||
| package.json | ||
| packit.yaml | ||
| pyproject.toml | ||
| README.md | ||
| tsconfig.json | ||
Cockpit
A sysadmin login session in a web browser
Cockpit is an interactive server admin interface. It is easy to use and very lightweight. Cockpit interacts directly with the operating system from a real Linux session in a browser.
Using Cockpit
You can install Cockpit on many Linux operating systems including Debian, Fedora and RHEL.
Cockpit makes Linux discoverable, allowing sysadmins to easily perform tasks such as starting containers, storage administration, network configuration, inspecting logs and so on.
Jumping between the terminal and the web tool is no problem. A service started via Cockpit can be stopped via the terminal. Likewise, if an error occurs in the terminal, it can be seen in the Cockpit journal interface.
You can also easily add other machines that have Cockpit installed and are accessible via SSH and jump between these hosts.