-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: armel
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: armel Build Daemon (arm-ubc-03) <buildd_arm64-arm-ubc-03@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 fd802e785f30eded01b4d70b5a2640af499613cc 5444476 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_armel.deb
 1cf060a0f5cc3bd487095c741ef9062d25a6dbf6 1177624 nagios4-cgi_4.4.6-4.1+deb13u2_armel.deb
 449b7c532c780bdf77da046f8bb672b0a9108ceb 725284 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_armel.deb
 2503189b957901b21e99756b3ce5a8fb68c12a21 222708 nagios4-core_4.4.6-4.1+deb13u2_armel.deb
 50f2679425b9a371cc8fc6e1362b2c98dba8b93a 10340 nagios4_4.4.6-4.1+deb13u2_armel-buildd.buildinfo
 b84a9dfc67a2db059436352f1295e705af2d1a98 16800 nagios4_4.4.6-4.1+deb13u2_armel.deb
Checksums-Sha256:
 c6c1187fe28c6616d792a993c525125a007a5c2c57eefe71b656cf94725e0ee3 5444476 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_armel.deb
 66571d84f6dd3ca62cb26a8f7db34825d4a8dc53722cd9b82166f8e6ee9f6de0 1177624 nagios4-cgi_4.4.6-4.1+deb13u2_armel.deb
 5410296a88a3c6ea08f35dd48dacf2b7024d4f427c6b7322028e50a3c10fbed4 725284 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_armel.deb
 312b7ed6eabb439ae625ee8b5d544b13071a86a9056f9bebe087822af4ecfdc0 222708 nagios4-core_4.4.6-4.1+deb13u2_armel.deb
 9e9e6e61ac396d821d9fc262b0986c2848087cca11d31a91cca153602e9b697e 10340 nagios4_4.4.6-4.1+deb13u2_armel-buildd.buildinfo
 33838faaa46df163ab45cf89cbf2bb333a53a9b9e95c3c7d3f376c579188d3cf 16800 nagios4_4.4.6-4.1+deb13u2_armel.deb
Files:
 1f850f781987cffcd67d3e30c89bb3bc 5444476 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_armel.deb
 57878a85fb6ff9a583a5fdb7040c16b4 1177624 net optional nagios4-cgi_4.4.6-4.1+deb13u2_armel.deb
 ddb27c2d884f61db117a3d0521ffec23 725284 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_armel.deb
 78100f33a79cfb9333d63cb8b914f9fd 222708 net optional nagios4-core_4.4.6-4.1+deb13u2_armel.deb
 1424a9b100260b84ff6e2b7feaed3612 10340 net optional nagios4_4.4.6-4.1+deb13u2_armel-buildd.buildinfo
 e4e4f8604c53135491641060a5832344 16800 net optional nagios4_4.4.6-4.1+deb13u2_armel.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2kd8oHy+LXk/nybqvzDqKQSGl8UFAmrK6PAACgkQvzDqKQSG
l8UrkQ//byMillkHm8W90X9pjNJZH9I0hJRolIDBSFMirin9G4zPG0fdJB5FaURP
Zs34Cl0L8wRMa72BISTHOmOJGHbpAeK6EHatgfGwLVdiNp7ums7hhsz3/5XpAMRh
ajsGvpvDTUl6PN2WqseXa7+H65AEBPDtsdxqy7m/+uJ4WSALvn7dRXlD4t0JTAcE
p1iBs+qI+kU5QMzHuRsbTQsr/8v8Zkt5YZUN1Lw2UhtVNO7vVs3j6Xx8sDi72P1X
gao8BrF4gjRN/RUglk0uVYArm3TncbC000Igv8dmpHN9TM928wOB61rdFOFjvZXV
QjtyTayl2Kjej7K2lQoHUxXS1IihYAJvGO1baXSyezNemz8MOJ6EH9Z1Dz8alhRJ
sCeB5/UM9urYmazLj6MIJdxi7d5SWvMDmmNyhh7ONpLF7Dsd3N8vUa+DEgLI8g+x
UIJoW4/elBls9n/Yonmq5NzRQcc2e9URSrldcN5TxFQoSqev9VutC0u/6R8t/AHY
+x6DmNaKu1FS4JbePefPFBIS/n+F3s7GXnu5Nq694lE/0NzcNiBFrvhyjdvuVsmN
0SOUaWyGgFE/3D+btV23FgeL7H6Zh7RO29xsZ9NWNctRRV9PqdtXgS7zmWvyDQmH
WhxorL2JHgwaCEjup8GeWCZUd/2HbZZhG2c0/uVXOUfsSGR8j6s=
=w9TJ
-----END PGP SIGNATURE-----