-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: ppc64el
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: ppc64el Build Daemon (ppc64el-osuosl-02) <buildd_ppc64el-ppc64el-osuosl-02@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 3b2c6c2dbf3e2fa6d105b08547704d86a14d8ccd 499824 cockpit-ws-dbgsym_337-1+deb13u2_ppc64el.deb
 7b454bab0b2782ffae344fa054e9ed2607e17cc3 1046676 cockpit-ws_337-1+deb13u2_ppc64el.deb
 d8eea7af413c1796fd9871339df6ff6f6d9a36f4 11584 cockpit_337-1+deb13u2_ppc64el-buildd.buildinfo
Checksums-Sha256:
 c3cf27e8e8de477b2e3b548b3642fd999371702e430ab5b5c72b57f767ef2edb 499824 cockpit-ws-dbgsym_337-1+deb13u2_ppc64el.deb
 3080be072260c96c69ed695b7304f0407aac99c69503e7934a5d8fe51ce3044c 1046676 cockpit-ws_337-1+deb13u2_ppc64el.deb
 67102335842ab4aa466d0903ba2156b9930d5996463f5bf8c4d7b2986a3739d8 11584 cockpit_337-1+deb13u2_ppc64el-buildd.buildinfo
Files:
 4953bab1a7282bf47ff7937f944e5f75 499824 debug optional cockpit-ws-dbgsym_337-1+deb13u2_ppc64el.deb
 552e1109bb0272c6455ac90118e173d1 1046676 admin optional cockpit-ws_337-1+deb13u2_ppc64el.deb
 7f16c3f45273d98407dd8a43aa917273 11584 admin optional cockpit_337-1+deb13u2_ppc64el-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE9ibmwdV9gdKNbK7oV8ucRsMTpuMFAmqP3c8ACgkQV8ucRsMT
puNatg//V+/3mg0cJD2cVWCCuIDltFjF8mYJAqAbAYRRrYIEs3sKDU0zOAxl+XpK
pzH/GIEZ5fDCkEpdwTq5JLB45fdmaPJz3CpMk61bP4ff7lNqubISCFUQIN582M7J
ZNscP7yCmY3EFkaOdaSC2po2TEOVqUzpzXhxSFPyLwMF8dXwviMw3fxdshXwbR/s
v9csLXaxT4DzB3d0RgXl8iT4K6ZdD0Cg7Hz9ny46T07nkBYcxXeCPVYj3TprMCNV
BXHS0x7FB/iwmTF9PahLLyUTapHqbGqSG6Txwc3bt1T74eCF2FgpQmE0crk8+jp7
AP4zWFWFKS6KJ6c3arZR11F3dYJCSB9OmOx7OMHyHUmkxUFCLb5SsCM9V9gTh+d0
3dh6jIOUTGeVjwRn/cYxqwXiloDv8vrVhvXLJFxHyPUZCxVjKhM40l7wGvfHjTpk
LcoXdnqhWWbWPnPiVFS80vIxreZz70AJ/kOvbu0USeTDik3yP7rBBXG1fRTFFAPX
seuS4ZVV0mk+TGbCV0uxs7thdlYxlrSAiZvRVNgZq25M5vacKZK/vWmRBUJ1LMHD
hS++KS8w8f1GuK+a57HMNmEraxXe58U/7huEFuMGHpHjFPzB+pKLKdUd77BQVAf/
uq0R1EHUjIs3KId4s9YkFg2AoV7ypBFRxUvbbsmzLZSRX2Mjy+E=
=sSix
-----END PGP SIGNATURE-----