-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: amd64
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) <buildd_amd64-x86-conova-01@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 b36f18d5855a13997f10c536bfac223566019288 5647404 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_amd64.deb
 db37c52a225f2a193178fbf5b09b9230f758d6ed 1334184 nagios4-cgi_4.4.6-4.1+deb13u2_amd64.deb
 626a917101526112273dac799e10e9864b2af2ae 737532 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_amd64.deb
 afd2aa6eb9676548ffcd62610bf6b3448c5ae8b3 251660 nagios4-core_4.4.6-4.1+deb13u2_amd64.deb
 1d303443dd0c44fc3a81d9000745662e8da778bc 10488 nagios4_4.4.6-4.1+deb13u2_amd64-buildd.buildinfo
 8f0844676a474821cce7e06e609be20f0036dcbb 16800 nagios4_4.4.6-4.1+deb13u2_amd64.deb
Checksums-Sha256:
 f5578f563e5a5b18775f8ef3d5c63c5206943e2d99be5ffac88d0417d7eeb2d8 5647404 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_amd64.deb
 f9a87682c99ab824dce9fc1c10735da17bbb681f7e3107e2d3aeacc602c14410 1334184 nagios4-cgi_4.4.6-4.1+deb13u2_amd64.deb
 4a4dc33043a0179fe5d5745bee79e4904f24646f37d566246ef6ffbd07714280 737532 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_amd64.deb
 9be1406d221a60ff4057c1eaa43ccb4cc99616e5c3f0277494b1a87597fe6c03 251660 nagios4-core_4.4.6-4.1+deb13u2_amd64.deb
 91505bb72b82874bada4b44f15d065c920eddfd0b67427aa13dec623ebcea7a6 10488 nagios4_4.4.6-4.1+deb13u2_amd64-buildd.buildinfo
 4e095542866f503952db156bec758c910da7a9ee59fd338865bb75b2a2f967cc 16800 nagios4_4.4.6-4.1+deb13u2_amd64.deb
Files:
 9d93014d0fec89f496675b8c233f9446 5647404 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_amd64.deb
 7e3b18e6c255b11e8e1274c868b79c0b 1334184 net optional nagios4-cgi_4.4.6-4.1+deb13u2_amd64.deb
 d36e6c9a74b7adafebd50744493c91de 737532 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_amd64.deb
 e485a8952ac8fc3441488835cef0544b 251660 net optional nagios4-core_4.4.6-4.1+deb13u2_amd64.deb
 7719bab9d076def843a7c45dfc476571 10488 net optional nagios4_4.4.6-4.1+deb13u2_amd64-buildd.buildinfo
 01bae51743aa23de403df998264cdb8b 16800 net optional nagios4_4.4.6-4.1+deb13u2_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmrK6McACgkQPkCWRKsh
20dTWg/8DIrCcvR1Jnz/ESUb52MBd3QIjCZqPh9fqblHWuB22+EehXjENSpv+W6s
Lw0L7mPTlUoZb3kWkjji0oxoSJQTFU0TemSe1sn9Ss3mJsjW4mhqRmFDsA3XAmV7
74o82GWn2JDkjSJNPYUCDC5niMZE/OHPdPVh5YC5cKAp/D1xEW16BTnVf5/F9aw2
Vr0W5bUQROKbn+ygdku5FWU6UQ51u9ghBWtm/+nuOn7UyR0dhAS7xMsLlfacI3Tp
vFQ3AP8uv3rSD7cdd1aXSJL+hJ8CpPgu0G/dG+1Ej+S4NyNAF1Zvs4MIg12OTU61
gj+4s1KmTFhFwegwca08cpgfY3VrmIwzyw1h701eqESLWMBKsLDTAWa+aVWmzXp3
cnNy0Ah8Cf/0XN1S0Md0Vw29fhdRb1At74wB5XevJjoWfhEvIzCKRmI53EJuYGEp
pihFfzn+9FfAjArkOLtg2SO/xcEyRRpU5VIaVKO0vA2e7FxBka+cazSRBcbKIxcB
Or26fLTV+UAGn/WURl1zgdJagFxlBFy/P5g7Oe8ihlqePJLPfwljN9otLQU+trXf
DxFLQ+GNWTgOeSP0V+f+QouBl95LVhkocAQq0USxR9onFfxjTAHUKM2alvv/jbVX
VuNQo2iPqXF4oj2tbxtkX776zGF67vYncHimKixAcfBnl/hN8pk=
=vLxa
-----END PGP SIGNATURE-----