-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: i386
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) <buildd_amd64-x86-grnet-03@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 48ae124f18e95060883acf1895e024d35c8d54b1 425716 cockpit-ws-dbgsym_337-1+deb13u2_i386.deb
 3fb51bfbc387ca8a9b42a560e6f3951377a211a8 1050440 cockpit-ws_337-1+deb13u2_i386.deb
 986b397227527f3a7eff93228af3f405b56752a8 11486 cockpit_337-1+deb13u2_i386-buildd.buildinfo
Checksums-Sha256:
 5e2ff03e67961eb83b7896fbb104a22d3b51c2025a250157f3b01ade65404722 425716 cockpit-ws-dbgsym_337-1+deb13u2_i386.deb
 70e69a8baffc96192cc2590eb4ae389f34e7a750ad5d948e698af65d8813cebe 1050440 cockpit-ws_337-1+deb13u2_i386.deb
 b2e066e93458938ad39db750ba43deafe0f03bf95977a2f5bacba1b2d69683cb 11486 cockpit_337-1+deb13u2_i386-buildd.buildinfo
Files:
 b79cf49955bb47e7f64dffc90c1234cd 425716 debug optional cockpit-ws-dbgsym_337-1+deb13u2_i386.deb
 c185b22db12d81578f70c6a335ba5b1c 1050440 admin optional cockpit-ws_337-1+deb13u2_i386.deb
 a84d5bd80dcaeba0c4271def898e439a 11486 admin optional cockpit_337-1+deb13u2_i386-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmqP3gMACgkQN8Ugyu9d
QiR/uxAAoUFBcRKq6qokBjCaxCz4Xc/jWiTORvnXhUsqB4fWHrE9/4w6wpXfLGIH
WiRI3mi44FGBvuAFkeQl1fBu4xEITWqF3DBBk/v0sCRF0kObCuQ6LqqNUTMTgeDG
KzLGYAMFM3CCy9Hm+dwKRMMklru9Sm40m6PjHn0P1j8ioPj2Ce3OcY7/v8ubNqrs
/iNmnc2Diw+gDsr/vJolrypzCttOWsI9v6VJVdSeoKGYDnL3pz5fjv5JQxLJIFty
sGnglgelo+WzIDnU0U0QXsHzOD5HCXl7eytiw3QsTSKx4gW/h1fYW+HgO4BGcbrA
dW1e9nQ9w/aUyqE+0dITtQC9kF4Af9z+52Lx+Mpk1NhcrxZktlDnDbQcbY9WMDP4
U3EuAUGUcW6oUs0A6Ul+Ew7nkURjCtqLxsEW8NG9KC+j9MBdy2kWhT95ZfTsIAuT
cmKG2kgHK81waCdywf2HTiTe3UN4xAENYhPPiSsUDOKJkUU5MTjKEXlhOLRNkBrb
Physsewo/Z75d9lERzkIsfMhvfEjtY/PR0wWGDY1/taffnKroLbU3kwd2+mJeYX0
RKhof59eU7ewbdLWp9q3FbtSh2J9isi1nSFpCzz//SXpHw7SB5LzuOd3B/KJjE0L
cd8AKDoi4HZwPk1nivXdyxQGRVC2B376GmPqHqONREvCy1sApxg=
=y/65
-----END PGP SIGNATURE-----