-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: riscv64
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: riscv64 Build Daemon (rv-manda-01) <buildd_riscv64-rv-manda-01@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 6b36ce93a5c367dc5ba43dc8d44126e054c936df 5458860 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_riscv64.deb
 bbdb027916d263af9d51177c3c0decbea0b33639 1346884 nagios4-cgi_4.4.6-4.1+deb13u2_riscv64.deb
 e10ef31aa1dcb80a9af3a019d2835998686fafc1 718224 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_riscv64.deb
 b9dd7f351a98e922172469639694a5616f6dfb75 257536 nagios4-core_4.4.6-4.1+deb13u2_riscv64.deb
 0fc6c13616418d0c2c86339a53a6e9c5fd1958c2 10450 nagios4_4.4.6-4.1+deb13u2_riscv64-buildd.buildinfo
 c05d2051f1bf625fcff649fbae6edc6b80c162b9 16804 nagios4_4.4.6-4.1+deb13u2_riscv64.deb
Checksums-Sha256:
 77d55f525a8014f66529be0703661724d18b93355db2324a31865d7d60f054f6 5458860 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_riscv64.deb
 346a7fdf30e101a3f521ee361b182cf3f77763b2a51a0f28df39246fe3b83351 1346884 nagios4-cgi_4.4.6-4.1+deb13u2_riscv64.deb
 cfbf84273a0a5d7e7cd186ef8ec728c6f9d83892ec8587d98f83e3755a39caa8 718224 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_riscv64.deb
 dd96cb8aea9c99fc714243389931b5fa8a5b45a9b0bb5147475169e281689962 257536 nagios4-core_4.4.6-4.1+deb13u2_riscv64.deb
 f8c5b2ed960c3cc765fd9c64e2cb0ce1bdfe2b89d3b724c86cec839f9290a313 10450 nagios4_4.4.6-4.1+deb13u2_riscv64-buildd.buildinfo
 eea377d3f66bb9544f8a607bbbd9bf6f70a1bc7f17a17426a2c3e6158ef2fd99 16804 nagios4_4.4.6-4.1+deb13u2_riscv64.deb
Files:
 847b6c7b07e4702167668bddc9e522cf 5458860 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_riscv64.deb
 b315390ccfd2aab13b630f0a35b5754f 1346884 net optional nagios4-cgi_4.4.6-4.1+deb13u2_riscv64.deb
 21440adfc8f75951aa927bf20343767b 718224 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_riscv64.deb
 2ec1c08e331e507cb5f645a66d8fa952 257536 net optional nagios4-core_4.4.6-4.1+deb13u2_riscv64.deb
 1d50cbc7e9bc4c4435e590bbc68f6c07 10450 net optional nagios4_4.4.6-4.1+deb13u2_riscv64-buildd.buildinfo
 ba14de6ddec3a4bcaa7600c44d9ce577 16804 net optional nagios4_4.4.6-4.1+deb13u2_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwN+C+Bc8deN4UliX50ghctvtZFQFAmrK7CsACgkQ50ghctvt
ZFQhJw//edK5/jRQyp8T1QB1m/NK9oPSO8DLBLn2su9Yqu/coQg1l5y1Yvrc5Skg
FQpJ0hhSG6YxVNOH4oxXD5pISPDY/AiZ0rey5tB6+C5rrqXcvtrfKPAsuXo0mnYf
pfNfkXWM+N/i6jzhPzyIqUy4Ctchr4F5UXp4vyAbbN6K5iKV9h9eS6F3nyfYVsH3
XYryOrVVgHq6SVQSsoGTZe54DoKVYp4ghDJTucJViHGVnYRIBqNhqj62Tq3Ap0Sm
g8fJSbGoJFNaBdFMjtZJz/vyq6zRBulm6CyjFlERTmjK0JtbfJ8qoyFIwqi2keZl
sKOlilHVIzR3LlqQl9XhyHFLT7w3+kgV6W92V0zBNledkUdraW7b4+0wFOvLEeZ7
rhsWlXoKJmiWjJEy7DnqSvX7dZqiNrCRc3fLrj9xoTOcCCCaK7FS1es35CQcBL/A
AQeGLKPejxwmgI+4/aIBsS3Yk1ABZy41imVuFRMeRU+3W5w+EEwMDmumeJbPEGoc
T36MCAbGktj/GqKC81RJs9W4RTA2klXw/oOAXkHLfQV+vHrNZOzOktMZEmO/28Fm
a3x7y2c1ybGUQTKTSJZ4CcG2Eq6GQ5M9UC6N8liEWcH8IKhD1XF5H1fIFdHOAvjh
mj3TYbvFzs2swbaSes/gQqQPZLbhpOF7Sh/EbB2Rc9VnVDfw0OQ=
=XZ+g
-----END PGP SIGNATURE-----