-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4-common
Architecture: all
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4-common - support files for nagios4
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 4016e6386a165f43f4020451164d8b51a5bac3cf 71892 nagios4-common_4.4.6-4.1+deb13u2_all.deb
 4aba19f04cc618f1026fe581963c33d39d38192c 9258 nagios4_4.4.6-4.1+deb13u2_all-buildd.buildinfo
Checksums-Sha256:
 f9047018f6f40acfb2b56a3adc6d209877beca58a8e1cd56ec12327c2522222d 71892 nagios4-common_4.4.6-4.1+deb13u2_all.deb
 b51a108dbb476cac20b374e4f3d37438f3219e723d5e40674d778fb340efd364 9258 nagios4_4.4.6-4.1+deb13u2_all-buildd.buildinfo
Files:
 7a3bea2a3b4b8607be9a2ad89afa4e54 71892 net optional nagios4-common_4.4.6-4.1+deb13u2_all.deb
 403d56fc1054d4de540153f2521117c6 9258 net optional nagios4_4.4.6-4.1+deb13u2_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmrK6LgACgkQmgPNRvTf
/zduIw/+IFXeeFvEZlz6j2gg9X+lmz2G7GkVjh3CXBzSqh40qeyGadblCVSGoyDi
Su9GZ54zLkgVBf66UH1jTW8O8gGwPJFHnB6ZQ6UZZHaD6JtD8Ng2XxLCSFKjLJjA
YRFq0zExFMaGWcSzLyTIOF0xXQXKD88axyGK8sHAyE+um+a127Qo01w48Zn53Z8K
qRjbysUbP5Dikys5Mnq4mBOObWC0LvUOVx4l31agEJhuFsKIWU5ZD4kMja0/n8kX
Ao8IaHQ0eEa1UeU81Z8rftpscwmvl/6+30HQe2dfmFVU0FYrL5nb3BFPcPEJoo6T
FIXsNraX1U9jCh7y5kjeSrjKT1lvF87BVcRFYZssIJTjC0U8kA4w5H4MwbFVxwAy
+kkozzEHDhwy6qwLPB6SgGMfxZBar9XGnoZtiPzAml314QZeaxo/JZdJLadxj+ur
TnwlxIneQXq1QbGsGKYIhT7AL81XqRdMRS3pHGmdOBqsL7ntmsfnDHEP9jvt9Cx5
fdmN1U9xalVLQ9h6rCgA2cxSSJX/alq1/Iv1tQTXNf0pj6McBFioF/IUL2hvdakL
k+gvvjsfymKu/eIDRQqMEYLMgaEn0PSl2JHCD0QDAqTn0bOgoPv/LavBA8BEtn20
u2id7DHyDFPCgq6PoUSxJKBkYsgiaoEVr+TsMr/l5ADyozhHA4c=
=Eg/w
-----END PGP SIGNATURE-----