-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 25 Aug 2026 08:35:13 +0200
Source: cockpit
Binary: cockpit-ws cockpit-ws-dbgsym
Architecture: armhf
Version: 337-1+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: armhf Build Daemon (arm-ubc-06) <buildd_arm64-arm-ubc-06@buildd.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 cockpit-ws - Cockpit Web Service
Closes: 1144975
Changes:
 cockpit (337-1+deb13u2) trixie-security; urgency=medium
 .
   * ws: Free "language" string also when it comes from the cookie.
     Fixes remote unauthenticated DoS and huge memory usage (throttled at 75%
     and capped at 90% via systemd slice resource control).
     [CVE-2026-76235] (Closes: #1144975)
   * pkg/systemd: robustify argument quoting.  Fixes arbitrary command
     execution via crafted links to the system logs user interface.
     Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in
     debian/rules to the built bundle, as this branch does not yet rebuild
     the bundles during package build. [CVE-2026-4802]
     has no effect; instead apply the equivalent change to the shipped
     dist/systemd/logs.js.gz via sed in debian/rules.
Checksums-Sha1:
 149b52aadd122ecb0400dad5b9e5ef9d6f363bc4 483320 cockpit-ws-dbgsym_337-1+deb13u2_armhf.deb
 6de0e77568d52f2850105366ea68591444b39fb9 1020244 cockpit-ws_337-1+deb13u2_armhf.deb
 c71febf0566e397ab066de68aefc6ec1f79aa43e 11451 cockpit_337-1+deb13u2_armhf-buildd.buildinfo
Checksums-Sha256:
 4ece6662ea8ab865279d0f0531373756ebda1c6de3ef2fc60e5b73c0cd29abde 483320 cockpit-ws-dbgsym_337-1+deb13u2_armhf.deb
 386fd01bdb889f2a69b446e40ba43601a1d1a5e5b6aa3d135e3de750ccb11485 1020244 cockpit-ws_337-1+deb13u2_armhf.deb
 4559214d13649bf0e82987eae45dfff00b3d99a0971eff32ea6f070383a0492f 11451 cockpit_337-1+deb13u2_armhf-buildd.buildinfo
Files:
 4539d86e6916e5041eb983b2cd38fee9 483320 debug optional cockpit-ws-dbgsym_337-1+deb13u2_armhf.deb
 b7d90bb4b3d006bfe8fc8df9b65fc583 1020244 admin optional cockpit-ws_337-1+deb13u2_armhf.deb
 87e68b1274f009a7ff6b68e61c4ee01f 11451 admin optional cockpit_337-1+deb13u2_armhf-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBOUsBrtd5lcy6oRfutMAkCxKbL0FAmqP3X8ACgkQutMAkCxK
bL0Daw//bT8hHG2m4d9DjRU7e3xUoIgoSRkNCnT7mVw3xCqx5s3Ro189tv8cIksH
Ojzv88rm8oEjWK9fO8lFKuaXuKSDxahF4EEqvLlwus3/9OdWHQnfuZz8kWBTR/Dk
Ur174XB1BQwsbjtuIa0KkGHzKb5O/ALwHI42M9gbXchpZjHh1YvHt/jHm8UNUwug
yWtzSUj2kqOI3QjPd6xVxvVviO7culOl9cnCrRa+QcfBvPmS3dVZkMbjRDLpLEY5
11ecmCdbBLsDaRA6fVWjwWQSnjsRy3i5xnpB2I0/a2PR10jIKIz1tHvo4i0FDXTy
CFcOxqaZ02nO1ydm6gBRjVXvZNLMZ/A0dIxVW4VEQBjD/veMIjRCaYFRYwZYIecE
lS7PVkLLmMIamwieCE+S62OqGSDrUn4q2GfWji7wL7UYpLO/gx2StiKT6E3IOseg
P4+VvB7pm+TJAHPfov+bnHV48x6i+uFmf7tc6CrzCtp8sx1jBl8UGwSW0QSti14V
5DTxmefhfetxT9HaNvJwIOfMyykrUQFDVghvEBoqhqMvZ7VUEROPVgsfKWGhYo6z
m/fHvCeUDXaMCHp6eNrTh+PoK3g87+x7bXY5o1KI28SL9GCLaR16eejr34yQJN80
1xFw10uCvpJwCiR3TJhddR3Ng67agWFD2YA8qjkFGz+lQ6gPW5E=
=AdrA
-----END PGP SIGNATURE-----