-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: amd64
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 7f9843cb701d437761854320d4c51ec33a19f218 499284 cockpit-ws-dbgsym_337-1+deb13u2_amd64.deb
 35ad76b02c5581c691b1bc0e06ff8de1e2b7122f 1038576 cockpit-ws_337-1+deb13u2_amd64.deb
 3f049a91a3d950f4d7f7a89fdd93bb5735f9bdc8 11585 cockpit_337-1+deb13u2_amd64-buildd.buildinfo
Checksums-Sha256:
 f8fff75fbdb690f55ff5161735bf87a41557774e1c8111692360f5d9f0aeb876 499284 cockpit-ws-dbgsym_337-1+deb13u2_amd64.deb
 f74347e89be9f25da9645f2975cb9d8227333c2461782bd701b6cf9fcc43ff1c 1038576 cockpit-ws_337-1+deb13u2_amd64.deb
 5b885d3779e01a9d43cbd8d551186ef5a9a26b99704fbfd2da250313c4d36fce 11585 cockpit_337-1+deb13u2_amd64-buildd.buildinfo
Files:
 d932f94819eeac0c0a479f2d443f6c55 499284 debug optional cockpit-ws-dbgsym_337-1+deb13u2_amd64.deb
 9bbc1fd02d176a3c5a275d04c18f4962 1038576 admin optional cockpit-ws_337-1+deb13u2_amd64.deb
 dd59d173607e949096746bbff47d9b08 11585 admin optional cockpit_337-1+deb13u2_amd64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmqP3bgACgkQPkCWRKsh
20fGuxAAmZPMamX2SuEMPLxJQqpa3IPu2REy/YfKDj2iKp44s5sMqPvwe2VTMk6k
ZhluhLZykp0T5KG0OfZtYd9R3YLo2dRKBSEjQ1S7Jau4IKmES/4rxLCrS9lQC770
IDygdYKdo81aUtt6Dh1CzkNsfCuBzEbE3KI3GzlFaEsxln8UZssm6eoL8/KvPaeG
BBrFGUP087LGxAswCCpoFW41VEzl4kO4eCKZxDewHt1b1L9jU4958Bh74ybKjErv
3dFMEdzJ22B9qCdxn1DSQd06ud8G6AydZTYZE5/WlT+VrYhX/sTZXGVt83upSKDT
kyNAev7t5amMAHBv4mN4v3LHhAz6//Z7okThtJCbLGD0k4QVtseCkTJT5+8IJ19c
wh6ufzBj/Z6O9n4K37au1vnXwq+gZKUWLI2p9qMYR9pett7Glbf7da2BUogTEHLM
IQaK+1KfRi5GVI+7MxgTVSB+bkcPsF4oj5i9WkE0etcTIIp50RV6XJE0gkro+bo5
cBY0p/cW2c95IAlsvCQblaDEFSrEwbQrKqcGHOx1KInR1lMur3XNGlRDr69t+Cp9
uHs06KpZ9cKlGU6StoA6FfWN3itVfai8zSWurUpkvF6o1y10DFPUDUqj0HXxAHqw
3Ea63gxcu7vbRYAxSlMmsQd+S14ha74QgsXOT8KA8iAUs5A81u8=
=5L0v
-----END PGP SIGNATURE-----