-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: arm64
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: arm64 Build Daemon (arm-ubc-01) <buildd_arm64-arm-ubc-01@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 1f4e7604561d30c704bbfb884d7641836c3a3c22 488288 cockpit-ws-dbgsym_337-1+deb13u2_arm64.deb
 67736ecf4fe3ed5a35be646a159b2223c7b4b898 1028896 cockpit-ws_337-1+deb13u2_arm64.deb
 8d654cead82646933bd3b21f7a3e4a6805dde415 11569 cockpit_337-1+deb13u2_arm64-buildd.buildinfo
Checksums-Sha256:
 0013ea62a63e6e8a06171abe31b79693755e1ca3a5a53ef2d9def0e31a12bdd5 488288 cockpit-ws-dbgsym_337-1+deb13u2_arm64.deb
 4af22eab0c00d741ee976f1f8cf71a33f2709242ee81be19933ee1fd592202b9 1028896 cockpit-ws_337-1+deb13u2_arm64.deb
 9e3c2eee503bd66f06c9694b7063d6e0f9702af0c4683a2a835c2cde90bad6b4 11569 cockpit_337-1+deb13u2_arm64-buildd.buildinfo
Files:
 09b86c64f205a110dbe6ecd9fa0a38f6 488288 debug optional cockpit-ws-dbgsym_337-1+deb13u2_arm64.deb
 38dc2f27b31f6f41e15d184cbdb4fcd1 1028896 admin optional cockpit-ws_337-1+deb13u2_arm64.deb
 dd95f69d818a132da2adf299e67a8147 11569 admin optional cockpit_337-1+deb13u2_arm64-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0Ha//LlsGOpbQ/H4xqCFmsOWgoYFAmqP3ZYACgkQxqCFmsOW
goZW8xAAsAblA0rtqnewW1Qr9pFppbYI5Ov1IZC2YMcSiTXGu8bBR/mRkdT10MeZ
8eyLcUh+G9Ah+zFf9aHXY0P+Y81rMZNPDlc+0T56y4PXJFURmH9+trEkxQPXo7ZZ
QcxSD2HVNtKHiUNqGoQu+g1IFlVNw6kH0/lCmIVI/TUuUAuw5SYOcEtj99UYS000
hMFfSIckAiQAtyoL/yOIOYnkkXd+8cTd0Tp1bxfzlUEqaRBZlKWDog3LhL5cWfNz
nhkZZrDgMeLV3wo7o+myUCll+0kHBUQveDUoX4F5IxSVOjWtN73S/vvrt+60cAta
ZwUIPww0vttswAOVnGwWqEbuteWIwCseyNJTFF7cA4mrZwMj38D+PznKtPbOHMB4
Sk9/5JdxKBLT5snStDPYjxFzqKA35MI5jGHiu74KT/HRwZxoRmGphgRuDkAx6qc0
XaKp7RXPIC51R+qP10uX+dOH+3TV2Cy1rJ+WwEbp1jsfZPUt611FdhYPocaG0G1R
v4t7L3LEnp94sPbkUm3xSPTGmfOEijoYIi0CItErpRzGBMhgLUIZc5UzA6+LqyO2
uLXgAtjbLwJLWH19PXCN089SCgAc+wBrLZaJmeFKF3aSkn0SEgVmzKEaUELd7q+J
oh+JLWEr6JDigwOZQ3At5j3iBK4jsx5tQtbxUqbZov6fal6MvX8=
=HGs0
-----END PGP SIGNATURE-----