[Pkg-utopia-maintainers] Bug#1152782: cockpit-machines: CVE-2026-113495

[Salvatore Bonaccorso]

Hi Martin,

On Wed, Nov 04, 2026 at 11:05:08AM +0100, Martin Pitt wrote:
> Hello Salvatore,
> 
> Salvatore Bonaccorso [2026-11-01 17:07 +0100]:
> > The following vulnerability was published for cockpit-machines.
> > 
> > CVE-2026-113495[0]:
> > | A flaw was found in cockpit-machines. Red Hat Subscription
> > | Management (RHSM) authentication tokens are passed as command-line
> > | arguments to background helper processes during image retrieval
> > | operations. A local, unprivileged attacker on a system permitting
> > | cross-user process inspection can view these arguments while the
> > | process is active. This flaw can lead to information disclosure,
> > | potentially allowing unauthorized access to RHSM resources within
> > | the token's validity period.
> 
> Upstream just did a release that contained the fix, and I uploaded it to
> unstable. I'll also update the stable backport once it goes to testing.

Thanks.

> However, given that RHSM is totally not a thing for Debian (or even Fedora and
> CentOS -- it's only for RHEL), I recommend marking this as "won't fix" for
> stable releases.

Right udnerstood, was just not sure how "common" it would be to
adminsirate RHEL machines with a cockpit-machines instance on Debian,
but I guess that is unlikely :)

Regards,
Salvatore