-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 25 Aug 2026 08:35:13 +0200 Source: cockpit Architecture: source Version: 337-1+deb13u2 Distribution: trixie-security Urgency: medium Maintainer: Utopia Maintenance Team <[email protected]> Changed-By: Martin Pitt <[email protected]> Closes: 1144975 Changes: cockpit (337-1+deb13u2) trixie-security; urgency=medium . * ws: Free "language" string also when it comes from the cookie. Fixes remote unauthenticated DoS and huge memory usage (throttled at 75% and capped at 90% via systemd slice resource control). [CVE-2026-76235] (Closes: #1144975) * pkg/systemd: robustify argument quoting. Fixes arbitrary command execution via crafted links to the system logs user interface. Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in debian/rules to the built bundle, as this branch does not yet rebuild the bundles during package build. [CVE-2026-4802] has no effect; instead apply the equivalent change to the shipped dist/systemd/logs.js.gz via sed in debian/rules. Checksums-Sha1: 5101f7ee3eacb6266915e79888b2ca5abd7676de 3007 cockpit_337-1+deb13u2.dsc 9a45726c9e5e5078e2d69ec9eac5676171c972bd 14759784 cockpit_337.orig.tar.xz 17a7844eb71db11fd8d667231cb43ca726614796 25428 cockpit_337-1+deb13u2.debian.tar.xz 88ae2f9ad5bb5fc65309dcef077051b403a3e146 11176 cockpit_337-1+deb13u2_source.buildinfo Checksums-Sha256: 9ba12b9ebdadbcb34d78fd039997e0ef936e98ded322ebf9862fb5224b124def 3007 cockpit_337-1+deb13u2.dsc df51ef5920fae69e1b435f657376aa93772c0c1720b954a3bac10ebba26bfedf 14759784 cockpit_337.orig.tar.xz c5fc9d0f56a16d5af3fb6ecd556d174664fbd7f5abe26d470bb4d7f147f0f55f 25428 cockpit_337-1+deb13u2.debian.tar.xz a98671103fe4b5ce1b71a1ca0b267d4dc19888cd2a1b6425af81abd2a0c9bc6c 11176 cockpit_337-1+deb13u2_source.buildinfo Files: 5f68ce133c1b614da5a41b48fca7f24d 3007 admin optional cockpit_337-1+deb13u2.dsc 9c03bb1048d7bfa99bc5e3ca953457e8 14759784 admin optional cockpit_337.orig.tar.xz 3d8b239060116ad0609b45379478864f 25428 admin optional cockpit_337-1+deb13u2.debian.tar.xz b0b9c2767f0c29ca0e8cdda94441d80b 11176 admin optional cockpit_337-1+deb13u2_source.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmqP2QAACgkQ7nvd5Lhr VxPCmxAAl8vlCHqXqwZPwTa9EZ4ekGs5PPiQiI9m01tjOtagq19AW7Gvi6kV2ZQn G8zMyp7jO4IUjYkxcy06m2Ji2COjOzSZmTtn5Sv/gi3swkbT5sC9hfxSE2o4bT6o VMs5ISyEpiuZliooArktWHq15GumQXvE6kM90yDe1R0XcxmCdgr9PQ6ppH89Pd+F MdE8CMw3Ytz8vNiRCAAx1Mx+7zzrevGwa2uwhxsKlMe2QKDYC8qJyJHCpsVAPZEX QVb+DUKrujo4z2QxIZNKnBjaoTOd5GP3XL+lk2HcmB0UwW1J5FHekoxxQwFxgTsR E+3EuLQD5ynjMQr2ksZD7n7tPPddltCDDl+TsaKFVjTlOLXGSMhLv9PuwEKPIrS+ Edkluv+C19cpRSG5M0t9ZIFe2bAljufhchvDZS+cgMgn/EK9F05oTY3LgB3bHoLW U2GWieiqgViUNozxCRhcCJ7h02rV3Fa9CYagQdb2KVFBcYkNc9th3E7QgnS9hILE kXuIeWU905NECwZKIwNHPbEfh/qWgpd4MxFxFPCepQdFbQCJbNEX7O0d1TSaR0X/ ulcuH7RBwWuOBjo9oB0uCVB76Frgj7M2pnrjmQqL1SyDwGo2iR+9YUQ8XUvth0wL vBjAV7BIqgGfRocX6Q7zzKqbuxuuDWM1UNYcdED6Tx7CWKCNr+I= =vBwn -----END PGP SIGNATURE-----
pgpdWq64dzxLH.pgp
Description: PGP signature
