Buongiorno Salvatore, Salvatore Bonaccorso [2026-08-21 6:07 +0200]: > The following vulnerability was published for cockpit. > > CVE-2026-76235[0]: > | A memory leak flaw was found in cockpit-ws. The login page handler > | leaks a heap allocation on every unauthenticated request that > | carries a CockpitLang cookie, allowing a remote unauthenticated > | attacker to exhaust memory on the host and cause a denial of > | service. > > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
I prepared a trixie security update, attached debdiff. Please let me know if/when to upload. Thanks! Pitti
diff -Nru cockpit-337/debian/changelog cockpit-337/debian/changelog --- cockpit-337/debian/changelog 2026-04-09 05:29:56.000000000 +0200 +++ cockpit-337/debian/changelog 2026-08-21 06:56:55.000000000 +0200 @@ -1,3 +1,12 @@ +cockpit (337-1+deb13u2) trixie-security; urgency=medium + + * ws: Free "language" string also when it comes from the cookie. + Fixes remote unauthenticated DoS and huge memory usage (throttled at 75% + and capped at 90% via systemd slice resource control). + [CVE-2026-76235] (Closes: #1144975) + + -- Martin Pitt <[email protected]> Fri, 21 Aug 2026 06:56:55 +0200 + cockpit (337-1+deb13u1) trixie; urgency=medium * ws: Be more explicit when handling hostnames on cli. diff -Nru cockpit-337/debian/patches/series cockpit-337/debian/patches/series --- cockpit-337/debian/patches/series 2026-04-09 05:23:29.000000000 +0200 +++ cockpit-337/debian/patches/series 2026-08-21 06:49:49.000000000 +0200 @@ -1 +1,2 @@ ws-be-more-explicit-when-handling-hostnames-on-cli.patch +ws-Free-language-string-also-when-it-comes-from-the-.patch diff -Nru cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch --- cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch 1970-01-01 01:00:00.000000000 +0100 +++ cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch 2026-08-21 06:49:49.000000000 +0200 @@ -0,0 +1,29 @@ +From 233b1c178dcb95ccef356832afd9d60023d601e9 Mon Sep 17 00:00:00 2001 +From: Marius Vollmer <[email protected]> +Date: Thu, 20 Aug 2026 15:23:08 +0300 +Subject: [PATCH] ws: Free "language" string also when it comes from the cookie + +See https://access.redhat.com/security/cve/cve-2026-76235 +--- + src/ws/cockpithandlers.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/ws/cockpithandlers.c b/src/ws/cockpithandlers.c +index ab61f1325..465b6bec9 100644 +--- a/src/ws/cockpithandlers.c ++++ b/src/ws/cockpithandlers.c +@@ -482,7 +482,10 @@ send_login_html (CockpitWebResponse *response, + + g_free (cookie_line); + g_free (content_security_policy); +- g_strfreev (languages); ++ if (languages) ++ g_strfreev (languages); ++ else ++ g_free (language); + } + + static void +-- +2.53.0 +
signature.asc
Description: PGP signature
_______________________________________________ Pkg-utopia-maintainers mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-utopia-maintainers
