-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: armel
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: armel Build Daemon (arm-conova-02) <buildd_arm64-arm-conova-02@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 635451a53224a57b03987fc531f62a0c56ab8bb9 490452 cockpit-ws-dbgsym_337-1+deb13u2_armel.deb
 183c7e3493b3a63ef60c0b45410452d39a822a13 1018732 cockpit-ws_337-1+deb13u2_armel.deb
 df03a1b434f596b9cc1ad21553cbed5ee98f4516 11437 cockpit_337-1+deb13u2_armel-buildd.buildinfo
Checksums-Sha256:
 436941d60350503f167361f8e2b3713cf3b42ed2d3bcae435dec05b465d8ffe7 490452 cockpit-ws-dbgsym_337-1+deb13u2_armel.deb
 d5c127c1ae1b39162de7e158b50a5bfd2bee23507739199b39c4eda15fedec47 1018732 cockpit-ws_337-1+deb13u2_armel.deb
 7229ceeb0c43d130d35e708afa8b32f6c9c7a4383685b45349657de367e1702e 11437 cockpit_337-1+deb13u2_armel-buildd.buildinfo
Files:
 c29ff4db701d0402f7aa85248488e236 490452 debug optional cockpit-ws-dbgsym_337-1+deb13u2_armel.deb
 82c6356eabe0ce7522d47690e4df2cc8 1018732 admin optional cockpit-ws_337-1+deb13u2_armel.deb
 0daca940da0ccc4b9eb2ec04ce41c0f1 11437 admin optional cockpit_337-1+deb13u2_armel-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEa5s+5E+WDkV2pQjwIyDMsRzdi8EFAmqP3ZkACgkQIyDMsRzd
i8ED1A//Ru0UXpBzV2eRSSjTC/27fHiUOUPBlGKpWsQlYwsInnIIlrReAJUGIgvu
tsWxl2yJpO8avx1ex1vnWJj+THibBHPQqc06FaDZWtLXKuoUkRv07SowoJc8krcv
c6cxTio8pFynxk6Uh4vH8pZoI9wEMT873kUoqaObrC5BvNruRjdweKoyziUWbBBc
wYsvjsms37VkNDdAeXcoFeSJzSuALrkFhQAA7vtxWZVlMVFrpXRo4xvkQqD+yOv4
F/+4+9Wq1KJfbeeqAyvUrUfsrB3goMS8qjSYi5LNCnRna83lWqJE0n+IgDtJeDX1
6AE1KyxIf2fHNnt8TvDp7I3iHh85Icoos686Q4H1CRGToE90Qny+QTvhageNGG6G
10Oeh3K0T06ikKuBPMEhbiWNDHY5L/Ngvljj0o+njzkhKtwbg6C5BK+mjFOPSTC7
Xcv9NF6SSmsN4wySQLnXs+b8b/D3VSj2xyaMqOzugotzySCKNQIVDU2T9H9v4WJG
WNHuK2O14bIS1F/Lrcy1uoLN/wAa6xNJqvKEruixB5vJ2v4iGn0gBInqABrMld/2
6KM8ivGudHx+3cwHaxvPwpY8GMJMAiUmdIVBZKh0Cz13TqN0PM0RkXnSGDjchfI1
KBtfeF5w3+6ANyu0CYI8Yxz+LfL3YP6UfKfDCDWDL67CjJCQgfs=
=sjcW
-----END PGP SIGNATURE-----