-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: arm64
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: arm64 Build Daemon (arm-conova-04) <buildd_arm64-arm-conova-04@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 db705198da1020d50e0b2611b0c5e02457c638cc 5744544 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_arm64.deb
 47b7a5cacbc7c73cd7b2da63b286a5a11aab54fa 1275536 nagios4-cgi_4.4.6-4.1+deb13u2_arm64.deb
 2f35ae39d0bb0c0f9952a16b6c9f9989a4f07311 744416 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_arm64.deb
 b21dd25bd6928ccaaeb2d0e7776532f1dfc99c7c 233260 nagios4-core_4.4.6-4.1+deb13u2_arm64.deb
 96f9d11cc321879c4385315aac49f98c665a82d3 10472 nagios4_4.4.6-4.1+deb13u2_arm64-buildd.buildinfo
 2a960ba4129242aaf4f14c5350e01eb1b8212567 16800 nagios4_4.4.6-4.1+deb13u2_arm64.deb
Checksums-Sha256:
 48a06aea910837514467489e8cc3391b2ddaf31e5fa408cc6b7eeb880a88ac34 5744544 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_arm64.deb
 cc72a7686b95f33d0afdaba012e53544943c0b53c57f0d3cf6ba4bbdbd5d0710 1275536 nagios4-cgi_4.4.6-4.1+deb13u2_arm64.deb
 e89d30c50013800b977a712691b488e741e3996797b610fefbad04ac911dd4fe 744416 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_arm64.deb
 c3d6052657cd4ab1d6c439ab41fdc52a477c6899f63d560fb5e6bb861d29e35f 233260 nagios4-core_4.4.6-4.1+deb13u2_arm64.deb
 18b5aefe7a37c4ae68de8265b1e52f7148cfebcdd0a9ed53be82400d8dcde62d 10472 nagios4_4.4.6-4.1+deb13u2_arm64-buildd.buildinfo
 b4a55b8649c1cfa5d1aafdd7f086f7c578c1e35067e8b751985f60c50578f388 16800 nagios4_4.4.6-4.1+deb13u2_arm64.deb
Files:
 0ff4cc92d24abb1894a67a5fa086a3b0 5744544 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_arm64.deb
 e8558d5c7c8d66bccdc7dd4200358243 1275536 net optional nagios4-cgi_4.4.6-4.1+deb13u2_arm64.deb
 b7a739efe993c303e67e39fd749ab422 744416 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_arm64.deb
 cce4592aa47d0ab91a8db8734bf57df1 233260 net optional nagios4-core_4.4.6-4.1+deb13u2_arm64.deb
 6bf199b6283acae7cfbacfcd93c33e4f 10472 net optional nagios4_4.4.6-4.1+deb13u2_arm64-buildd.buildinfo
 fb55f0021109f0b643cfbe9cdf148ff4 16800 net optional nagios4_4.4.6-4.1+deb13u2_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEgSZRd/+N1Ed3hy+mPMAxAOQQpzsFAmrK6LYACgkQPMAxAOQQ
pzv+4w//aqoZeGvSM2pnZaWRg8LZ2cMA1qxrHC1P0YXeaM6sCRywUKJ6dxFr1V+7
XLhAXF/1h5I0ZBigULl2CqW3sHrC2xvguypvployrLg5VRjdh590qoHwWR5Uk7Ue
wC0TOfpdzDu26/kvNN6Rc4/cFZNSuiDG0cctLda0cxp0tDM8SK0+06RrJ2c9P3SJ
6dxN4YF4VguP8CLazOpE9wLYUVc0JQ7dQULwKBmmQZOYNcwjoUjyFw3Ug7c9DeMN
MHsqBkceasZhS+cssrr45giO/FR8QPB/VG8K/ghz12KW4v4EWe+S4/Z2g2wurPsN
PzubEI1y3Sl2pU604vOxKsBFVA2zv0np9B9LpFR5KXRYrxO3phGvyyqAYYsxyOgl
GfxJM3WeAs4OIvMm21/M8XBJCGU/l46wwoXr/KZyEOqOmF6qENERLItQ53CBfUfC
KmUwoESyyspmhOcbxXrOJthLUi9IYJXRN6McJDpnrg957GOek5tCbPFljCmc9137
Y8AwFhlFYvDFNv7ZEYRZafdfUzqQxA3taIl42iUi/T5WDUc00FPcBYw2w3ABAAF3
RkIVU4v1Kkl7rgb1aNuIgHUKallTGiEdJei1vL7jtGNAtr55LOKr8p4SsltWTQkv
AelpzziqjAWlVAhke7w5wDTrncCAlCo2kKXqhEdL5yplaJfZK0w=
=K82L
-----END PGP SIGNATURE-----