[From nobody Mon Aug 31 14:49:08 2026 Received: (at 1144975-close) by bugs.debian.org; 31 Aug 2026 13:47:10 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 78; hammy, 150; neutral, 178; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:45868) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x12Lu-007OM3-2N for 1144975-close@bugs.debian.org; Mon, 31 Aug 2026 13:47:10 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x12Lu-008JHf-1i for 1144975-close@bugs.debian.org; Mon, 31 Aug 2026 13:47:10 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=L6CMB/W3eDB7dQEAHMFrdGrCCV+xyfaZqzsx6wfjzv0=; b=jgiZwEOXSegNJxuOKqDAF+mcC+ B4VfbpvtBMqVpJo877oZIf7eJ4DuULaWv1Ezqp2vhYdpDYiaNXJOculpoyqkZA8NSWyVJpNA6ErG0 a0ryZkjxx4elcqhz699XtYbo0C82R853mCAosLlIaUuiI6tX5x6vCXMmWd+ppQIon5rqyIwnj/+Tw s59GTKi0AK72JUpE2sy0W6lRaGknr2tVRryYm5Ccp3gUD9J9OkRK8piLTnRaNgZSnjFdoDsVrEYdB qM3bDFUig9JqSJlLTVVPdAOKBCYrqhP0mCZpGaPsS5gSh0KvT5vRl1rISJjCtd5DV4bL4oijyaY2S sg8rD30A==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x12Lt-000000050Ce-3M6s; Mon, 31 Aug 2026 13:47:09 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Martin Pitt <mpitt@debian.org> To: 1144975-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: cockpit Debian: DAK Debian-Changes: cockpit_337-1+deb13u2_source.changes Debian-Source: cockpit Debian-Version: 337-1+deb13u2 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1144975: fixed in cockpit 337-1+deb13u2 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============3736999115789870567==" Message-Id: <E1x12Lt-000000050Ce-3M6s@fasolo.debian.org> Date: Mon, 31 Aug 2026 13:47:09 +0000 --===============3736999115789870567== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: cockpit Source-Version: 337-1+deb13u2 Done: Martin Pitt <mpitt@debian.org> We believe that the bug you reported is fixed in the latest version of cockpit, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1144975@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Martin Pitt <mpitt@debian.org> (supplier of updated cockpit package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 25 Aug 2026 08:35:13 +0200 Source: cockpit Architecture: source Version: 337-1+deb13u2 Distribution: trixie-security Urgency: medium Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debi= an.org> Changed-By: Martin Pitt <mpitt@debian.org> Closes: 1144975 Changes: cockpit (337-1+deb13u2) trixie-security; urgency=3Dmedium . * ws: Free "language" string also when it comes from the cookie. Fixes remote unauthenticated DoS and huge memory usage (throttled at 75% and capped at 90% via systemd slice resource control). [CVE-2026-76235] (Closes: #1144975) * pkg/systemd: robustify argument quoting. Fixes arbitrary command execution via crafted links to the system logs user interface. Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in debian/rules to the built bundle, as this branch does not yet rebuild the bundles during package build. [CVE-2026-4802] has no effect; instead apply the equivalent change to the shipped dist/systemd/logs.js.gz via sed in debian/rules. Checksums-Sha1: 5101f7ee3eacb6266915e79888b2ca5abd7676de 3007 cockpit_337-1+deb13u2.dsc 9a45726c9e5e5078e2d69ec9eac5676171c972bd 14759784 cockpit_337.orig.tar.xz 17a7844eb71db11fd8d667231cb43ca726614796 25428 cockpit_337-1+deb13u2.debian.= tar.xz 88ae2f9ad5bb5fc65309dcef077051b403a3e146 11176 cockpit_337-1+deb13u2_source.= buildinfo Checksums-Sha256: 9ba12b9ebdadbcb34d78fd039997e0ef936e98ded322ebf9862fb5224b124def 3007 cockpi= t_337-1+deb13u2.dsc df51ef5920fae69e1b435f657376aa93772c0c1720b954a3bac10ebba26bfedf 14759784 co= ckpit_337.orig.tar.xz c5fc9d0f56a16d5af3fb6ecd556d174664fbd7f5abe26d470bb4d7f147f0f55f 25428 cockp= it_337-1+deb13u2.debian.tar.xz a98671103fe4b5ce1b71a1ca0b267d4dc19888cd2a1b6425af81abd2a0c9bc6c 11176 cockp= it_337-1+deb13u2_source.buildinfo Files: 5f68ce133c1b614da5a41b48fca7f24d 3007 admin optional cockpit_337-1+deb13u2.d= sc 9c03bb1048d7bfa99bc5e3ca953457e8 14759784 admin optional cockpit_337.orig.ta= r.xz 3d8b239060116ad0609b45379478864f 25428 admin optional cockpit_337-1+deb13u2.= debian.tar.xz b0b9c2767f0c29ca0e8cdda94441d80b 11176 admin optional cockpit_337-1+deb13u2_= source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmqP2QAACgkQ7nvd5Lhr VxPCmxAAl8vlCHqXqwZPwTa9EZ4ekGs5PPiQiI9m01tjOtagq19AW7Gvi6kV2ZQn G8zMyp7jO4IUjYkxcy06m2Ji2COjOzSZmTtn5Sv/gi3swkbT5sC9hfxSE2o4bT6o VMs5ISyEpiuZliooArktWHq15GumQXvE6kM90yDe1R0XcxmCdgr9PQ6ppH89Pd+F MdE8CMw3Ytz8vNiRCAAx1Mx+7zzrevGwa2uwhxsKlMe2QKDYC8qJyJHCpsVAPZEX QVb+DUKrujo4z2QxIZNKnBjaoTOd5GP3XL+lk2HcmB0UwW1J5FHekoxxQwFxgTsR E+3EuLQD5ynjMQr2ksZD7n7tPPddltCDDl+TsaKFVjTlOLXGSMhLv9PuwEKPIrS+ Edkluv+C19cpRSG5M0t9ZIFe2bAljufhchvDZS+cgMgn/EK9F05oTY3LgB3bHoLW U2GWieiqgViUNozxCRhcCJ7h02rV3Fa9CYagQdb2KVFBcYkNc9th3E7QgnS9hILE kXuIeWU905NECwZKIwNHPbEfh/qWgpd4MxFxFPCepQdFbQCJbNEX7O0d1TSaR0X/ ulcuH7RBwWuOBjo9oB0uCVB76Frgj7M2pnrjmQqL1SyDwGo2iR+9YUQ8XUvth0wL vBjAV7BIqgGfRocX6Q7zzKqbuxuuDWM1UNYcdED6Tx7CWKCNr+I=3D =3DvBwn -----END PGP SIGNATURE----- --===============3736999115789870567== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCapWF3QAKCRCb9qggYcy5 Ifz+AP4sXgovXN4xF1EtzIDkwgS3eT/mQOwyTig7R1r01mk1qAEA+xTWkMROquVj YpjiM0Tg10DvFghHwr/aVXfaJPeEEAI= =eGEj -----END PGP SIGNATURE----- --===============3736999115789870567==-- ]