-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: ppc64el
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: ppc64el Build Daemon (ppc64el-osuosl-01) <buildd_ppc64el-ppc64el-osuosl-01@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 7384c155dd9083e486dc682ee318d069860ad860 6105376 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_ppc64el.deb
 0a398949e0d6399128960ae47b53c558217f4050 1344304 nagios4-cgi_4.4.6-4.1+deb13u2_ppc64el.deb
 74b119a8dfda577d7a4f7c40a5879501a2236c55 776036 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_ppc64el.deb
 9d79f1b376b50a10ad9cb6f021530287a88a7f7d 272984 nagios4-core_4.4.6-4.1+deb13u2_ppc64el.deb
 76f690af8cc008c696ee59e149b877438722ba37 10505 nagios4_4.4.6-4.1+deb13u2_ppc64el-buildd.buildinfo
 7d0b0f1d03e5c87f0f4f6da40aea397a61c0c6cd 16800 nagios4_4.4.6-4.1+deb13u2_ppc64el.deb
Checksums-Sha256:
 35fd5321577a6e6be9d3d35599b47a66afb35b9bdcdd9d371647cbc6ae7e8807 6105376 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_ppc64el.deb
 4df5499f90b904f70209ba2125a2d609139d9dcdec969b449da6b8ccdd34e605 1344304 nagios4-cgi_4.4.6-4.1+deb13u2_ppc64el.deb
 2f5d0bc9a5a740fda80ed3bc4bb63f425a9b88e5ab3b4094b5565f2e9c574a2b 776036 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_ppc64el.deb
 a3da879c100b66613d63970a280b9c2985e74215f40a5de6cacf7e526a987b0b 272984 nagios4-core_4.4.6-4.1+deb13u2_ppc64el.deb
 3b2e1d5d06bcc9ae8bb15b9bfeeeda8e7ba267d0a8412d874a84907d89f0c87b 10505 nagios4_4.4.6-4.1+deb13u2_ppc64el-buildd.buildinfo
 be3ec71727024f1f6cca1dbebfda64e755689c06e4a8c0ac375af3be982e9b42 16800 nagios4_4.4.6-4.1+deb13u2_ppc64el.deb
Files:
 45f3092cb8b8b14d90fd5b29fa807b5b 6105376 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_ppc64el.deb
 b0d908ed5f2fa3ff152307a6182368e9 1344304 net optional nagios4-cgi_4.4.6-4.1+deb13u2_ppc64el.deb
 a4f562d08f9194bbfee81d1cdfcbd93d 776036 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_ppc64el.deb
 da56ddac594a3351f3cbe5cfc65259d4 272984 net optional nagios4-core_4.4.6-4.1+deb13u2_ppc64el.deb
 0b3f07ff4671de0e6784e0bcea7bf9aa 10505 net optional nagios4_4.4.6-4.1+deb13u2_ppc64el-buildd.buildinfo
 56f3ef160f5fe8690811e209dfb57eec 16800 net optional nagios4_4.4.6-4.1+deb13u2_ppc64el.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETLpi2USYGUNSlYhoNINNphgym2QFAmrK6N0ACgkQNINNphgy
m2Reew//c495EV+g0UGd1o3CQ2/C2cAeSko8Ke0QyfnmPUOrKb/VmSoVWF4ozpao
izKZ2zwZDNegYzuBwVGmJ5jyNaUR+fe/7h8aWfD0nwjs+dJLnGHNjuNhWa8nlzui
lWZXk3PrCbhylbdgu0m3CnBZ/qf8vm39M9381/9xoC9Yn2/vBHuAzohPjh2I6s5O
6W54+diFNL7jUMjvdtccRa/Edua5zULOS6dK5Nbujwm0mCHNLkRV1k5MaookuH1L
dnqXjRwm4IWiFXb+VNdpY9GT7r4AARpNM3e/2kAcYFcVDrGPDUER/UdGKa+s6KIL
Z1MDh4cd5NQ6Qvg/lnM5ezayKDeeyLTSdhkddZAHkaKWSSECSf0qmX49HIX6jlj4
WtFiYEY2vsBSQvY+QpqKReQnPF2bFpvkfenxTDGsQz1A+IANvkGY6Ki2e8JqwIEV
tMXetAdKYUuygeIzJWxgI4y2Tg9aRhvT8nNI+YIYa8XnrcknigIIrGrYN7LIf5Sd
on9EeCWaKBw2nQYLSnnXPkWe2f+BcwP1d5cOnBCXBVv4w9owMHxD4Lt5Tu/lqhOa
gB1YucgEijFLXvRc5ntEHqff63zJKAACH4BPQJoTxwdSWuQLgV9PcRjuDqta7rY5
WigBCq62Olv6WwkbzKTZKNdhKTgMlubisuVCJqdLmdcY0K6oIpg=
=i500
-----END PGP SIGNATURE-----