-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: armhf
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: armhf Build Daemon (arm-conova-03) <buildd_arm64-arm-conova-03@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 ae93ea70bd1c78f366271e5cd6a9c624ffb0427a 5556424 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_armhf.deb
 ea4b8222d899ad6f4addd37ab0a4c82ab284a5fd 1199080 nagios4-cgi_4.4.6-4.1+deb13u2_armhf.deb
 a41c0d1ad4f8c5d5dbbb2c0ded26f331de3f0404 730904 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_armhf.deb
 e4154f0991faf45f6d09684a5cf4bedfc1e82c6f 227856 nagios4-core_4.4.6-4.1+deb13u2_armhf.deb
 91c5dc8a4181ddc35aa87d00c42354d892452ba1 10354 nagios4_4.4.6-4.1+deb13u2_armhf-buildd.buildinfo
 2a6396fa06ebff5400aa5baf0bed8e338bfea63a 16800 nagios4_4.4.6-4.1+deb13u2_armhf.deb
Checksums-Sha256:
 78ef5d1d861af1e07f651aa88e4288dc6b57cb8b704195869e641e3691f6ed1f 5556424 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_armhf.deb
 a19a55668f7138f0efe08d3537d0db89b7a6b0c4f7d45e2aa213dc4657cdbff5 1199080 nagios4-cgi_4.4.6-4.1+deb13u2_armhf.deb
 5720c590213b35b74bc078f4397f6d946f1716ab78c9d3e09a88cdc18356245e 730904 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_armhf.deb
 9745b5c48bad82f5f7da52c01279de31c75ceedc06c357d8b34f7901ece7aa72 227856 nagios4-core_4.4.6-4.1+deb13u2_armhf.deb
 b06b6663291697657e3253734691a5fd76611f9c30975b3b771bec134171b824 10354 nagios4_4.4.6-4.1+deb13u2_armhf-buildd.buildinfo
 c6bbace99f144043e24b01baf03d9d10f900e70cc1d33669aba7addcf3e7d103 16800 nagios4_4.4.6-4.1+deb13u2_armhf.deb
Files:
 54e36a9d448c53550f37666f79863dac 5556424 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_armhf.deb
 70a863861ccd95eec6155339afb31ae6 1199080 net optional nagios4-cgi_4.4.6-4.1+deb13u2_armhf.deb
 66cb35ead1e4b2d744595c08b12ef725 730904 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_armhf.deb
 b3d2ed7e129886c085099adb1680a50c 227856 net optional nagios4-core_4.4.6-4.1+deb13u2_armhf.deb
 f8c5ab392976c35d61942c2199e56a45 10354 net optional nagios4_4.4.6-4.1+deb13u2_armhf-buildd.buildinfo
 72267d27033daa55b1a1c5b8a84f3175 16800 net optional nagios4_4.4.6-4.1+deb13u2_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmrK6NsACgkQXVp1sEH/
1mLULQ//dM6r+JUDY2FGlLwyUhKp3mqzOIEaSh0b7VnCLNJEJI17ZstHpcFOzshr
lhuVIJk8fXkOu0UOMpyKqsbnYOfIV3IGXqrvg8TMc2bS38JMMYG519zBTPQUj7Gv
OGueHxXEuqKKMywhzL5g2j5frC00TGIvPeEbb46yBU6e1DKYF5ZBGggDpRbcAb4H
CTmI3lC+qxVmg6LIVHRT8QNqUkA52AndZURPnJgTYMMto32dwbYkQM1H5LvpOJUM
T8NNz/3GZTUv4Tqj2LRoPksRMI6/C7ndzXdoW8Irzf+ZB5DtQIE3bPqIL4c9CSpi
nXxiwyE+hNNMcCg+KUq/ATTlPF+zhUBmeymWze2lnRRt44K+jNNzldlwVDpTfkp2
DO/aoazkZP/9uB8Oj5/0wUT2IQFuEAlhs649E++nylHDluO6cI442wyTsagEw6KZ
/QxmFM8Tgt5LM5ppDWQh1x9I1WGVJhddIi1/ITqwv2kM5CThrehPtituwXFo07Is
XbqluV28WcpSxC1Y1EbIp6kUYdu6GRseB8uXL/3/OhR/JV3FxwcEA9ptXlPOb5dr
tHUfNEhFarKsLV/2RApLNZuEAQ5TJENpWO9Ss6qpWblZXMe+D0YFORLvuq/7Xu3H
dYf2SmoGDw0j0DHvP17YHl3Kc5bEH3aSYKzWu06jkrgAYi210UQ=
=nTtc
-----END PGP SIGNATURE-----