-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: s390x
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: s390x Build Daemon (ziehrer) <buildd_s390x-ziehrer@buildd.debian.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Changes:
 nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
 .
   * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
     tracked as CVE-2026-48548.
   * Backport upstream 4.5.13 and 4.5.14 security fixes:
     - CSRF protection bypass in cmd.cgi, where a request sending no
       Cookie header could supply both halves of the double-submit
       cookie itself (CVE-2026-48549).
     - Reflected XSS in cmd.cgi via the NagFormId parameter
       (CVE-2026-48550).
     - CSRF protection bypass via a self-supplied double-submit cookie
       (CVE-2026-48551).
     - DOM-based XSS in jsonquery.js (CVE-2026-48552).
     - Authenticated remote code execution via custom-variable macro
       injection (CVE-2026-48553).
     - Authenticated remote code execution via unfiltered
       NOTIFICATION-family macro substitution (CVE-2026-48554).
   * Fix a one-element heap overflow in getcgivars() when a request with
     no parameters carries a NagFormId cookie.  No CVE assigned.
Checksums-Sha1:
 3e373c0a2851f40fe197a47e413677e7a04cf8dd 5639132 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_s390x.deb
 0742b128e979a3aa677ece0c47f56e5337e2bda0 1248144 nagios4-cgi_4.4.6-4.1+deb13u2_s390x.deb
 ba81d2c67fc6f82e7ae6e624b69197cb4d862d05 746540 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_s390x.deb
 3b779fb096acf8ecaf4cd9ae52dcb5b8b7d1dcf3 238692 nagios4-core_4.4.6-4.1+deb13u2_s390x.deb
 dee0faee8a8545b15129bab285bc87e7f5e59943 10232 nagios4_4.4.6-4.1+deb13u2_s390x-buildd.buildinfo
 57b25659aa484dc283607c83a8fe5c682ac40ac6 16800 nagios4_4.4.6-4.1+deb13u2_s390x.deb
Checksums-Sha256:
 0c19ccb30df398e997dd6667dde478c08ec32911eafba4d6b65548193b400303 5639132 nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_s390x.deb
 03d359fd84671a1796f11ffd9a182407f9eec57b1cbf8b1bef7fe3567fcaea4f 1248144 nagios4-cgi_4.4.6-4.1+deb13u2_s390x.deb
 b4baa3171d66610e1415733a1beefc5edc4d4c21d5b10433977e3ad0dafd8bed 746540 nagios4-core-dbgsym_4.4.6-4.1+deb13u2_s390x.deb
 3aa099cc17fca334de21b168f1f8bc04d9d62a254d14524531d1cfb178a286d3 238692 nagios4-core_4.4.6-4.1+deb13u2_s390x.deb
 9b08cc14a76d9332afa401f4d1830c1ab54befedfccae22a60ec4d21a90316b0 10232 nagios4_4.4.6-4.1+deb13u2_s390x-buildd.buildinfo
 96d7c730050a53e9bde3d6aa794df3b86579572cc5e335e40e4587a8c115590b 16800 nagios4_4.4.6-4.1+deb13u2_s390x.deb
Files:
 772693227e09159fe11b72ae55db1c42 5639132 debug optional nagios4-cgi-dbgsym_4.4.6-4.1+deb13u2_s390x.deb
 bed1b73bb54f970b430f2f1d798b7a56 1248144 net optional nagios4-cgi_4.4.6-4.1+deb13u2_s390x.deb
 8955e8ef4a8e7abd636aca1802ac3ef4 746540 debug optional nagios4-core-dbgsym_4.4.6-4.1+deb13u2_s390x.deb
 af545a53ceb10ae8297032c47b342c5b 238692 net optional nagios4-core_4.4.6-4.1+deb13u2_s390x.deb
 1ef92547a4d373d1376ec23dcf97816b 10232 net optional nagios4_4.4.6-4.1+deb13u2_s390x-buildd.buildinfo
 acbab896cfd16af2046f8fb07ddad246 16800 net optional nagios4_4.4.6-4.1+deb13u2_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmrK6JgACgkQMWUFebkH
noRWjA/+OA9XFZF5FG/C8dxhND6OaFfWVFT+Sfug+Tfx9ebJLVDpNE8MJ93g/xJy
tshvUOLNbGSgWJfJ4dpIU35jUXR69XKX7J0wYdo5Eb03k+GFcaYzWVcSjEc2AqhK
t9YqZILkh+Ks9eGrGLxj/y4rRdk1a0nur7/1KDp3WlhVu6TA+Y6ZtEqaSTza+vGx
e8tgBQzuWafFh93nCWMEYZXdTUB5A4H5rkFTGW0roy6txqAr67z3GYPYfuCpKpIX
qP5a7Cxj2YF9ZxAKr/VJ/XMH73R0YpzlycCZO/j7XCIZIjmvXIFq9GDp1s2UaQC2
fdoePlM5w6B+PmgIQj+TGOr5d9Bm2PXK2+zr0r6Y8UDuOnwJ28OUjN40liiBRDOg
5Dm1riM7fWSCqB5OLgk+rJKT5cYauPI1RXZzQizG9nF8VmABjAXg/u8/2DNZHplW
eRRXG9c/soMZ02Ge3LL6MKu9HHeSciQiYIgN1b9VsK5ImhJNH00cGmKOK0MemMHE
AHmeiN9E2x2hpW4ZznzEh4O2Up2oFuc0rDMOUYqkVTimr2YQjcl8nCr5cS+4ND4j
Vjtux2G2dXHwugiFjeujfNqf8RfRbUkHzaaf1T5UbsNvIhjIITkToCi7u2iLo2fB
oyqt3gM2om56EyjAOjW4j4K1fP1D5XJM4N3gG2yB1BMmdKxW694=
=M3Nx
-----END PGP SIGNATURE-----