Version in base suite: 337-1+deb13u1 Base version: cockpit_337-1+deb13u1 Target version: cockpit_337-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/c/cockpit/cockpit_337-1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/c/cockpit/cockpit_337-1+deb13u2.dsc changelog | 16 ++++ patches/pkg-systemd-robustify-argument-quoting.patch | 37 ++++++++++ patches/series | 9 ++ patches/ws-Free-language-string-also-when-it-comes-from-the-.patch | 29 +++++++ rules | 10 ++ 5 files changed, 101 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpgeox70je/cockpit_337-1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpgeox70je/cockpit_337-1+deb13u2.dsc: no acceptable signature found diff -Nru cockpit-337/debian/changelog cockpit-337/debian/changelog --- cockpit-337/debian/changelog 2026-04-09 03:29:56.000000000 +0000 +++ cockpit-337/debian/changelog 2026-08-25 06:35:13.000000000 +0000 @@ -1,3 +1,19 @@ +cockpit (337-1+deb13u2) trixie-security; urgency=medium + + * ws: Free "language" string also when it comes from the cookie. + Fixes remote unauthenticated DoS and huge memory usage (throttled at 75% + and capped at 90% via systemd slice resource control). + [CVE-2026-76235] (Closes: #1144975) + * pkg/systemd: robustify argument quoting. Fixes arbitrary command + execution via crafted links to the system logs user interface. + Patch backported from upstream commit e3a47d70f99a0d, and hand-applied in + debian/rules to the built bundle, as this branch does not yet rebuild + the bundles during package build. [CVE-2026-4802] + has no effect; instead apply the equivalent change to the shipped + dist/systemd/logs.js.gz via sed in debian/rules. + + -- Martin Pitt Tue, 25 Aug 2026 08:35:13 +0200 + cockpit (337-1+deb13u1) trixie; urgency=medium * ws: Be more explicit when handling hostnames on cli. diff -Nru cockpit-337/debian/patches/pkg-systemd-robustify-argument-quoting.patch cockpit-337/debian/patches/pkg-systemd-robustify-argument-quoting.patch --- cockpit-337/debian/patches/pkg-systemd-robustify-argument-quoting.patch 1970-01-01 00:00:00.000000000 +0000 +++ cockpit-337/debian/patches/pkg-systemd-robustify-argument-quoting.patch 2026-08-25 06:35:13.000000000 +0000 @@ -0,0 +1,37 @@ +From e3a47d70f99a0dbbb427b3146ae9571cecc44296 Mon Sep 17 00:00:00 2001 +From: Allison Karlitskaya +Date: Tue, 21 Apr 2026 10:44:05 +0200 +Subject: [PATCH] pkg/systemd: robustify argument quoting + +If we were in Python we'd be using `shlex.quote()` here. Unfortunately +we don't have that in JavaScript but the approach is trivial, so let's +use it here. +--- + pkg/systemd/logsJournal.jsx | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +CVE-2026-4802 + +NOTE: This patch is documentary only and is deliberately not listed in +debian/patches/series (see the comment there). On this branch the dist/ bundles +are shipped prebuilt and not rebuilt during package build, so this pkg/ change +would have no effect; worse, applying it would trigger a failing bundle +rebuild. The fix is instead patched into the bundle in debian/rules. + +diff --git a/pkg/systemd/logsJournal.jsx b/pkg/systemd/logsJournal.jsx +index 26861106a..f19131359 100644 +--- a/pkg/systemd/logsJournal.jsx ++++ b/pkg/systemd/logsJournal.jsx +@@ -205,7 +205,8 @@ export class JournalBox extends React.Component { + const service_options = Object.assign({ output: "verbose" }, options); + let cmd = journal.build_cmd(match, service_options); + +- cmd = cmd.map(i => i.replaceAll(" ", "\\ ")).join(" "); ++ // cribbed from Python's shlex.quote() ++ cmd = cmd.map(i => `'` + i.replaceAll(`'`, `'"'"'`) + `'`).join(" "); + cmd = "set -o pipefail; " + cmd + " | grep SYSLOG_IDENTIFIER= | sort -u"; + cockpit.spawn(["/bin/bash", "-ec", cmd], { superuser: "try", err: "message" }) + .then(entries => { +-- +2.53.0 + diff -Nru cockpit-337/debian/patches/series cockpit-337/debian/patches/series --- cockpit-337/debian/patches/series 2026-04-09 03:23:29.000000000 +0000 +++ cockpit-337/debian/patches/series 2026-08-25 06:35:13.000000000 +0000 @@ -1 +1,10 @@ ws-be-more-explicit-when-handling-hostnames-on-cli.patch +ws-Free-language-string-also-when-it-comes-from-the-.patch + +# pkg-systemd-robustify-argument-quoting.patch is deliberately NOT applied: +# this branch ships prebuilt dist/ bundles and does not rebuild them during +# package build. Applying a patch under pkg/ makes that source newer than the +# committed dist/ stamp (dist/static/manifest.json), which makes the Makefile +# attempt a full bundle rebuild that fails for lack of node_modules. The patch +# is kept only to document the source change; the fix reaches the shipped +# bundle via direct bundle seddery in debian/rules. diff -Nru cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch --- cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch 1970-01-01 00:00:00.000000000 +0000 +++ cockpit-337/debian/patches/ws-Free-language-string-also-when-it-comes-from-the-.patch 2026-08-25 06:35:13.000000000 +0000 @@ -0,0 +1,29 @@ +From 233b1c178dcb95ccef356832afd9d60023d601e9 Mon Sep 17 00:00:00 2001 +From: Marius Vollmer +Date: Thu, 20 Aug 2026 15:23:08 +0300 +Subject: [PATCH] ws: Free "language" string also when it comes from the cookie + +See https://access.redhat.com/security/cve/cve-2026-76235 +--- + src/ws/cockpithandlers.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/src/ws/cockpithandlers.c b/src/ws/cockpithandlers.c +index ab61f1325..465b6bec9 100644 +--- a/src/ws/cockpithandlers.c ++++ b/src/ws/cockpithandlers.c +@@ -482,7 +482,10 @@ send_login_html (CockpitWebResponse *response, + + g_free (cookie_line); + g_free (content_security_policy); +- g_strfreev (languages); ++ if (languages) ++ g_strfreev (languages); ++ else ++ g_free (language); + } + + static void +-- +2.53.0 + diff -Nru cockpit-337/debian/rules cockpit-337/debian/rules --- cockpit-337/debian/rules 2026-04-09 03:11:13.000000000 +0000 +++ cockpit-337/debian/rules 2026-08-25 06:35:13.000000000 +0000 @@ -37,6 +37,16 @@ override_dh_auto_install: DEB_PYTHON_INSTALL_LAYOUT=deb dh_auto_install +LOGS_JS_GZ = debian/tmp/usr/share/cockpit/systemd/logs.js.gz + +# this branch does not rebuild dist/ during package build, so apply the +# minified equivalent of pkg-systemd-robustify-argument-quoting.patch to the +# pre-built bundle; the zgrep ensures that the replacement applied (CVE-2026-4802) +execute_after_dh_auto_install: + zcat $(LOGS_JS_GZ) | sed 's|a=a\.map(l=>l\.replaceAll(" ","\\\\ "))\.join(" ")|a=a.map(l=>"'\''"+l.replaceAll("'\''","'\''\\"'\''\\"'\''")+"'\''").join(" ")|' | gzip -9n > $(LOGS_JS_GZ).new + mv $(LOGS_JS_GZ).new $(LOGS_JS_GZ) + zgrep -qF 'a=a.map(l=>"'\''"+l.replaceAll("'\''","'\''\"'\''\"'\''")+"'\''").join(" ")' $(LOGS_JS_GZ) + # avoid trying to start cockpit-issue.service and cockpit-wsinstance-*.socket etc. override_dh_installsystemd: dh_installsystemd -p cockpit-ws cockpit.socket