-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: riscv64
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: riscv64 Build Daemon (rv-osuosl-04) <buildd_riscv64-rv-osuosl-04@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 25ac5878eae36acef465fb0de7c485fa85108abd 469736 cockpit-ws-dbgsym_337-1+deb13u2_riscv64.deb
 580eb229c128a771f15cf8acf0a8274204120e4a 1035996 cockpit-ws_337-1+deb13u2_riscv64.deb
 8996c5faec86b6687c604c1af7b884b07b901427 11555 cockpit_337-1+deb13u2_riscv64-buildd.buildinfo
Checksums-Sha256:
 e1885c0d16607df13d438b747a620af6ebb4f07cb3fd73e10febdf67e354b63d 469736 cockpit-ws-dbgsym_337-1+deb13u2_riscv64.deb
 23efb99ece768208fc7577e96891db53f0173095788494397046f3467af7ca57 1035996 cockpit-ws_337-1+deb13u2_riscv64.deb
 077efe5b10ff8b080b815fc822a7460dbf5aea23b944ef0922e89fec2ff3dd53 11555 cockpit_337-1+deb13u2_riscv64-buildd.buildinfo
Files:
 b9b80e9dae2593035cb2573d7250bc8e 469736 debug optional cockpit-ws-dbgsym_337-1+deb13u2_riscv64.deb
 da54023fd9dc4a1e94d618d04fe4ccb5 1035996 admin optional cockpit-ws_337-1+deb13u2_riscv64.deb
 41ca3336fc55eae62b8d23015b02b3a8 11555 admin optional cockpit_337-1+deb13u2_riscv64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgLDDByWcR07HDSHyNVgvumj7+mMFAmqP4CAACgkQNVgvumj7
+mPB/w/8DqvQhyOepA/iYO494TJ58EAZ70ntHzHpAV+e3gPJ/IjOOI9bkQx3meIH
xMgNZ34s1CAJDgNX2s66EAJirL3hRKRk/yoajCClrwKbsAXt//snJh4ok8VSvJbv
W0ae/QkB1amEdP1OSOEmaMKrArjkFWMY5jLrf2KSHLpLY96r8F9pr7/1zcxXx1jY
mobI2SF6m+rWvBwCg6mvLggJoJZL6NfcC6JDLNbxU0GqpbBfhPw/zJechutw6c50
DfOvBJbUlqjV+nfW1MPvYUkWtLWESSYBw7Fnk572eHigh8qsy0Mi79ZA7amTPF5T
3ReQXOZvVfLNOE8T25/b/Thjn5EZTVrdS7aLdGDf/7WcUJQI3OrqKHnZ0aeEZXIg
4DvEtrNstJl1Yz0ADj8MD72sXgeknALjml3Qn7ROzFuSD2YRvGYdCMuz3TMF8sdM
EBAluQh/PucX2HBIcBOTqOOtbM337FK5b79FWXmkkumeHAgKpXxtW+COHlSUBvED
vx1XR7xqQ9YFXVdo9+nGRZrC8cRRJ5RkKOTU+B2DxklWBr+jVVK53J6gY7S/IIcc
P7eE2zwxwVW5OoO/z7mBp1+rWFphQyLwUFOqJ/MhFbM7zNn8f3pGM/UErjjvPWtG
5P6nOGqOqELvxMVquLfNHieu6vkMtqarL/1xlfMoarAxC+q8bD0=
=hXvl
-----END PGP SIGNATURE-----