-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 25 Aug 2026 08:35:13 +0200 Source: cockpit Binary: cockpit cockpit-bridge cockpit-doc cockpit-networkmanager cockpit-packagekit cockpit-sosreport cockpit-storaged cockpit-system Architecture: all Version: 337-1+deb13u2 Distribution: trixie-security Urgency: medium Maintainer: all Build Daemon (x86-grnet-02) Changed-By: Martin Pitt Description: cockpit - Web Console for Linux servers cockpit-bridge - Cockpit bridge server-side component cockpit-doc - Cockpit deployment and developer guide cockpit-networkmanager - Cockpit user interface for networking cockpit-packagekit - Cockpit user interface for apps and package updates cockpit-sosreport - Cockpit user interface for diagnostic reports cockpit-storaged - Cockpit user interface for storage cockpit-system - Cockpit admin interface for a system Closes: 1144975 Changes: cockpit (337-1+deb13u2) trixie-security; urgency=medium . * ws: Free "language" string also when it comes from the cookie. Fixes remote unauthenticated DoS and huge memory usage (throttled at 75% and capped at 90% via systemd slice resource control). [CVE-2026-76235] (Closes: #1144975) * pkg/systemd: robustify argument quoting. Fixes arbitrary command execution via crafted links to the system logs user interface. Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in debian/rules to the built bundle, as this branch does not yet rebuild the bundles during package build. [CVE-2026-4802] has no effect; instead apply the equivalent change to the shipped dist/systemd/logs.js.gz via sed in debian/rules. Checksums-Sha1: 6b6ae6a815a22ce3c70c044e0640f06477907e7e 386192 cockpit-bridge_337-1+deb13u2_all.deb ff01c3aac075fa857d2482f6d3e992aa90b47300 134444 cockpit-doc_337-1+deb13u2_all.deb b3c52867dd6153b74ec92bf08255f86dc87e358b 864584 cockpit-networkmanager_337-1+deb13u2_all.deb 630246e81ee9f2477ca7849789a93b74c299a253 877220 cockpit-packagekit_337-1+deb13u2_all.deb 484766ebb20d002345ff95182cef8b0d601cab97 463664 cockpit-sosreport_337-1+deb13u2_all.deb 05a7a8b678bb0a386a29d398ad69958dbb8612f0 820492 cockpit-storaged_337-1+deb13u2_all.deb ee9c4fdc3612d84015033fd913cf9ecb77b46f2e 3302580 cockpit-system_337-1+deb13u2_all.deb cdca524d62040f17b466b83bd41783b01665ce3a 13334 cockpit_337-1+deb13u2_all-buildd.buildinfo 8fb2ea7353f95de0b69f942bba16fcbfd03d35fc 30732 cockpit_337-1+deb13u2_all.deb Checksums-Sha256: 8caa8c3f36d6eb2f95561614923518bc6e78d17962673d5be3d43b1967dc4961 386192 cockpit-bridge_337-1+deb13u2_all.deb 3f89410decf4b9e5aa356d47c1f058d114fb3c5e120ca3a4f6f69749ca149144 134444 cockpit-doc_337-1+deb13u2_all.deb cc65a198f07ad5a7e5e488a1cffca28fe395c9f9e3033411eb4c76e53614cb8a 864584 cockpit-networkmanager_337-1+deb13u2_all.deb efa7b906e09d4df3f3bac3cf2dc29065c01067ec6d30a838bfb3a832c00e4a40 877220 cockpit-packagekit_337-1+deb13u2_all.deb 92196dfb87c243d79350a9e4437797c271f7daaf113728d9323cc44d0a264133 463664 cockpit-sosreport_337-1+deb13u2_all.deb 74a6f8e1f0902c14218fbab791c582c32eb3fcb13295f7d61ca7ea83b439c8af 820492 cockpit-storaged_337-1+deb13u2_all.deb 309f12329a15cf5f465e8f8f328c70a1c24078637bb0e8334c10d88aad274c11 3302580 cockpit-system_337-1+deb13u2_all.deb a9d64bc4eb7bd0d77b9198420e8369d310e4d086a129ff934d371b433baa4132 13334 cockpit_337-1+deb13u2_all-buildd.buildinfo 5aaa70e06ced3a658c7fdbd8337b30d2aed2e0af829940414099e2aa1489c09c 30732 cockpit_337-1+deb13u2_all.deb Files: e14ab4eb670fba64e3ccf19995fbcb25 386192 admin optional cockpit-bridge_337-1+deb13u2_all.deb 255214e66160b8c215483876e36e1457 134444 doc optional cockpit-doc_337-1+deb13u2_all.deb 1b26e423a5da2dd3b7d7778691bdaceb 864584 admin optional cockpit-networkmanager_337-1+deb13u2_all.deb c0cae6674b1ec990c3ed2d255ccfe16f 877220 admin optional cockpit-packagekit_337-1+deb13u2_all.deb 045965eae3e6e9805ca917b5adb4c062 463664 admin optional cockpit-sosreport_337-1+deb13u2_all.deb 78d0c4062e4b28ead707454427422034 820492 admin optional cockpit-storaged_337-1+deb13u2_all.deb 28f661351b055b76c0b03577a9e175b5 3302580 admin optional cockpit-system_337-1+deb13u2_all.deb cc7c107cb68af02c0aa2f4f584755a75 13334 admin optional cockpit_337-1+deb13u2_all-buildd.buildinfo ac6dcb7a56b9b3499ac68c1a00cd7002 30732 admin optional cockpit_337-1+deb13u2_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmqP3coACgkQmgPNRvTf /zdJbQ//f6Z/GmvZQUuCCoI/u1AWYLyUBg2DH/PCAGu+/kej98rwr9LfnCjirP3r aft452rip//fsoEOKrgQiWuGnrxF/EtN/liDKpnAGSWrQpm5OzbeCemCBjOjglSr rg6dCGENWn30i4HqLJ7qsyB4dS0FzjFbLuSMmQbiYmVUbbTaLyxRmNurjGk+EXDS 585Vhet2cOLWdr13gl18htNq62ZNcvhcJWJ9k7UenRbhDN0+7ltQ75E4T3jVKLEf pL0Dg8j33+thqzPOltRv9kZUOoMMs6TxQzjr44N9dV8n/Z19sgMTSDiLkc4Lucmc mX913baxESDc0bvMWdea/WMRTNTrA2AsxUB8UajYZv/p4aucP1TPA4+l4keKhcrU naGeP7hRkZx2yg+OBQzYWBWo4fa7WoQzWShG++QfV4Kh5GK4dm/ecDkQrxMX4I6f zVXtqDIpdmzMnCtHsCuWDnODqJul8lUKagp50vrg3eG33gG3lRFmVRwC2HfpuCM5 dQtxN1iazjVXqB4so6aWXzrdRfSaUeVdYkSmiyq/qqDP1Qc6x20Njn1wuQi1wqxR TEWUeZaZsd6I1xcJG6Ha/5ElTT2rvyP6LSwbxpZ0UVxN3r2nIIoK0H0dpo4bHAh5 uvDgmGg7D+99umvtQzaeuOejozRNyu2hfqzuS+yzM+j+1j6mr7A= =GAUu -----END PGP SIGNATURE-----