[Pkg-utopia-maintainers] Bug#1152782: cockpit-machines: CVE-2026-113495

[Martin Pitt]

Hello Salvatore,

Salvatore Bonaccorso [2026-11-01 17:07 +0100]:
> The following vulnerability was published for cockpit-machines.
> 
> CVE-2026-113495[0]:
> | A flaw was found in cockpit-machines. Red Hat Subscription
> | Management (RHSM) authentication tokens are passed as command-line
> | arguments to background helper processes during image retrieval
> | operations. A local, unprivileged attacker on a system permitting
> | cross-user process inspection can view these arguments while the
> | process is active. This flaw can lead to information disclosure,
> | potentially allowing unauthorized access to RHSM resources within
> | the token's validity period.

Upstream just did a release that contained the fix, and I uploaded it to
unstable. I'll also update the stable backport once it goes to testing.

However, given that RHSM is totally not a thing for Debian (or even Fedora and
CentOS -- it's only for RHEL), I recommend marking this as "won't fix" for
stable releases.

Thanks,

Martin