-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 26 Sep 2026 21:52:24 +0200
Source: cockpit-files
Architecture: source
Version: 45-1~bpo13+1
Distribution: trixie-backports
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Changes:
cockpit-files (45-1~bpo13+1) trixie-backports; urgency=medium
.
* No-change backport to Debian Trixie
.
cockpit-files (45-1) unstable; urgency=medium
.
* New upstream security update:
- Fix arbitrary file ownership change with crafted symlink with "Paste as
owner" in privileged sessions [CVE-2026-91202]
- Fix symlink race in privilege mode when changing file permissions
[CVE-2026-91203] or creating directories [CVE-2026-91205]
Checksums-Sha1:
932845aadcd9969a36a3ec723d9c365af5f236db 2315 cockpit-files_45-1~bpo13+1.dsc
4950714d4416310ba9d7afb1b0c5db63b40753d8 7024 cockpit-files_45-1~bpo13+1.debian.tar.xz
4639b1f00ddc881610ba5da29e25c44b10d8a996 5217 cockpit-files_45-1~bpo13+1_source.buildinfo
Checksums-Sha256:
4c49ef04e31115c8b2d15f4cf3d53e38f869a375777eebd65224fba458a53fd0 2315 cockpit-files_45-1~bpo13+1.dsc
3bcb1a4359f7fc946df038ff2227052199eb244dd3b6174ee73e48c19d0a502d 7024 cockpit-files_45-1~bpo13+1.debian.tar.xz
4fb259431a3108db9c3f618ed12d3439d0dc8ab9a86dd054e8f70534e223a4ea 5217 cockpit-files_45-1~bpo13+1_source.buildinfo
Files:
4435baecb1884e6986fc34d92c64d73e 2315 admin optional cockpit-files_45-1~bpo13+1.dsc
480d0ad02d6a008ab7d723f536958d38 7024 admin optional cockpit-files_45-1~bpo13+1.debian.tar.xz
822e29fc6235a8a0248f47e140836680 5217 admin optional cockpit-files_45-1~bpo13+1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEbEuHi35jHxYFV8PN7nvd5LhrVxMFAmq4InwRHG1waXR0QGRl
Ymlhbi5vcmcACgkQ7nvd5LhrVxOGvQ/9EyT6F+Hg7i+3H80716WBydJ65QgeRVC/
Wy1EUi9RmThav01z0Uo1PKjLzOwTISGU2E5EIhUxyqfLJAirT8ko4+/+VXb5OS0P
84cRTSBZvr82UOmV0EaW7LrmNXaLRJqTBZ2C3u61vFiUajTclEumZC2A+Jz3V4pY
b2hr0Vap7Rrk2yrcWZnj9C12kDp3+BXeS1Z5Is6Yvkzs+4Bkvi9ClPzSiO5Fh6aP
ZEXlPM23P05ValQeDgIAHqhIu+gmeKwLVoG1YF2cdDw3ZSl8U59IC42JMU/0Ww9V
J/yqVJhkMgP8rGqYVNndbKofOZpkPn5giVQJg3WZSHGm697cp1ghzMyVobQuz9Cn
5VZI6JsioX/UkCq0BXcWTvh6SU71N50PxGrTfdQKGw6PyBDJBUScDRCxScgoL6CT
X8t43A3DDt8ZxNBP9neUUCZwdtpN2Loe99B3j0Zy9W57U6jrSiVr8DK3oUi+sTB8
9V/dKwyLXcC2ELkpRb9TSv1fTaspRf1wUYvy64ZKytaH/380Ak1T2dZSiCEmdL48
8Q5nlukLtFcVnSzB0BgFt3CZiSgYnd9u0S0ERKGIrEWlPia4fA/j1+FuUJdqnEYd
RcPLM0thIEZGhVQ5hXa4P8OBvaRzfm6l8h14fPvk1xVEfiXD06zcNDrvviHq4QpS
TAc/07wTo2I=
=wbzX
-----END PGP SIGNATURE-----
