-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: i386
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: i386 Build Daemon (x86-grnet-01) <buildd_amd64-x86-grnet-01@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 dc13dd3bbd788c0dc69d54016d78b1226252d087 4742356 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_i386.deb
 fee424e1b210015c13ef15d33770716ed255d153 1329612 nagios4-cgi_4.4.6-4.1+deb13u2_i386.deb
 93b45f1fc09340efe31d6af1b5df0f529b9afd5f 622940 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_i386.deb
 d905b86c507142e698574025d2a1dcf1ae95bb2f 264496 nagios4-core_4.4.6-4.1+deb13u2_i386.deb
 b537364fc435c19bfd1d4d6c535dd217dee0ad98 10380 nagios4_4.4.6-4.1+deb13u2_i386-buildd.buildinfo
 55454a6e748239ba946f39d9785e088727c7be47 16800 nagios4_4.4.6-4.1+deb13u2_i386.deb
Checksums-Sha256:
 83f22cf3921d801e38aeb7c2bad80be2891fbb0576828f7c3b886ac244a6a52b 4742356 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_i386.deb
 f8d91c27a061f9d4e641c15dfc52514f84ec662b6acba2909a81da537a04602a 1329612 nagios4-cgi_4.4.6-4.1+deb13u2_i386.deb
 d6b8ad2ade97b72fd051ef43273ffc4ea542e50c4999d471336ab204331dda22 622940 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_i386.deb
 c47686882489203c7946161e3126beb8bb1a830c74b219724eadd93cc50b4561 264496 nagios4-core_4.4.6-4.1+deb13u2_i386.deb
 55f7b75a47bb669c61db4854f5e1db56bde4de129a5efcc571f29d313f595bb4 10380 nagios4_4.4.6-4.1+deb13u2_i386-buildd.buildinfo
 9da394e5f8b7a9617d7b70b0ab40ad9d3a0b2e2c8a458996a78d9d58e61bdb8c 16800 nagios4_4.4.6-4.1+deb13u2_i386.deb
Files:
 1158ac7cebeb436f3aa118117427b228 4742356 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_i386.deb
 a58cb39b236fa9f317dd963a25de882b 1329612 net optional nagios4-cgi_4.4.6-4.1+deb13u2_i386.deb
 07a2a2e2a3ce99258d28331fc4a6f039 622940 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_i386.deb
 04c4682cae9e45f9df1bfab311904a92 264496 net optional nagios4-core_4.4.6-4.1+deb13u2_i386.deb
 fdbdbd1b0bd513c23624aa7df12d154d 10380 net optional nagios4_4.4.6-4.1+deb13u2_i386-buildd.buildinfo
 3b7958d9391214289c8d97ddffc5fb21 16800 net optional nagios4_4.4.6-4.1+deb13u2_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEPAUaMA0H0rOy6qBWf2INRiCdaWIFAmrK6M4ACgkQf2INRiCd
aWL+xg//ciRy1//4L3tSChk62Spbc5owaXxkNzO+kUMI+9xB2MyLUTimiXJQNKBw
8S7pIyOtNpU0/IihZ8rOjv5stb9rQloXcu9QPRgMHEiTH/gkiOCs0BBkvN4w/JW/
2054KmISKfIE361sNBvbzXrZ1aBUod5RPD3KR7AAgW9XMeINZJHwIxcrCjwifoIv
5+jr/BudBv3+3AY6aCCKqWwtHhAKCviYjitDsiugKklpH+YfuHPnv8fFlHOQq9rg
ZNmZjGioozKT9XrYnYsHS3X4QSYrS5tjqFgRqEdKl0QFR9caD+wCNM158MBORECB
lr675aIFIb139pcPIpHabxYwjGdFyiC+x0YnjiV3T0zC1SNNyPr051zdD2T4s8QD
hvgZZEnqHZGYioWT0uJzPiJ9AsX/V/yMDtP8WdRW8Es88LoR5HtbBBixzo780GY2
IbKgmmMk8tsKGBbh/mMJXeiAN/jzHUV+cW7GuSYqDUxlX6iEdoe/KGV1neGOdVu0
VNlwEv0AlgLMUocU2TZS3Z14UgFSZUSp8wWgv43XrMOxHSbH5n2ZBU6CYa5L6p6d
lUjysRRLpAbP9HPsJaTev3rzRelwmztWyDfL1xO97g1AKzmH5snDlAXVC1FP5KAQ
+KDFsuCS7wiH5BOuzs//MOdG3qqXMZh265r/q9jF5h5KK+I+PIs=
=XZ7t
-----END PGP SIGNATURE-----