-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Architecture: source
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Russell Stuart <russell-debian@stuart.id.au>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 87100cd432ff72bd40817dfbc0830416c2f9b2fb 2018 nagios4_4.4.6-4.1+deb13u2.dsc
 adba297297b3e861d49c75a4697b587375b9b374 1100028 nagios4_4.4.6-4.1+deb13u2.debian.tar.xz
 bea7b748a3308298a7646ebc50f8888a3b30bbc3 10991 nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo
Checksums-Sha256:
 8bd8a38e222f19a60cb16e085671917a784b9d2bdc892b60088f82e17aedda72 2018 nagios4_4.4.6-4.1+deb13u2.dsc
 f2b0759f843c2e5517e46c3f90f9f427d33737de18986f6b05c0b4839988717e 1100028 nagios4_4.4.6-4.1+deb13u2.debian.tar.xz
 d76e42f94048dbee44c6b399fda3f0bd95a75362d8fd4c0ef2a02f50325c5fe8 10991 nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo
Files:
 9cfd802db937ebca91aecc4e6f4411a8 2018 net optional nagios4_4.4.6-4.1+deb13u2.dsc
 7d60678aab9fb2ce9e5f3af866d000a6 1100028 net optional nagios4_4.4.6-4.1+deb13u2.debian.tar.xz
 ec85ba0f42c561b20beb17948083d5bd 10991 net optional nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrK4c0ACgkQrNSfiF5U
Um5aKg//bNFn5+fawP3XNZyoaxGyu26uSDWLcygRhTDLrxkbPzdxgjvEbge98KAV
pF/KHkxaTJQ8bUObBUX5IXaF7Dl1BWPg/SxlPhWjlql+P2ltXc5ke4Uwv1w9TZTP
VM3xjrv7+0JkqCxk42FqDvb+vJ7D/RivJ4A4z1+r8T2Sv4vzb0p7MeajLJVv6JkZ
kNHb9MeRLoWlQ+xJymRdKxe4/dIQEAAGS9oTny89x6yfE6zTb41nHRGzrRbQEmFx
4I7gfnJEHGt6bfj2/9Iexe0MdJvZYCVhqWBgaJkFTNiFAVVhRUl9WTq0892SveaL
aIgR6jZjtz6+HEmrKa3LwOunr317rp4kfrAH2nBuEafxrP0tenAXuYObecCr2qBH
9063bdJK6PTcRCLRpcE/8VNsYraeaDBs+/1YTUTO+CVKCy/keTLUvSh4wDRusGxj
9RO2hVCPvSzXz+g8HV2f+guf4rgnLbvbAkESShU3t5z6KTbCJpgsjGZSx5aqKNxO
fbG8Ti+6rNVl8yGwT6QJndiPb1FLwRlNNGkadpUv2X38Ey+6jcTUSOGSOt/ust/6
GDzvBruy4tMRGnJt+941n/prY3qRvC6e7iS0hZZhDCamIaqQ5+6TDnlmqSK89waj
1SoAtix/hqOGU5OT2wJ3r1skKFH8gku1pTyi3drOw9Tw43eyYO4=
=h42Z
-----END PGP SIGNATURE-----