-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 31 Aug 2026 19:35:18 +1000 Source: nagios4 Architecture: source Version: 4.5.14+ds-1 Distribution: unstable Urgency: high Maintainer: Russell Stuart <russell-debian@stuart.id.au> Changed-By: Russell Stuart <russell-debian@stuart.id.au> Closes: 1063514 1119147 1121618 1123716 1144495 1145888 Changes: nagios4 (4.5.14+ds-1) unstable; urgency=high . * New upstream release (4.5.14). * Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550), CSRF protection bypass via a self-supplied double-submit cookie (CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552), authenticated RCE via custom-variable macro injection (CVE-2026-48553) and authenticated RCE via NOTIFICATION-family macro substitution (CVE-2026-48554). Closes: #1144495. * Fixes the CSRF cookie bypass when no Cookie header is sent (CVE-2026-48549). Closes: #1145888. * The daemon no longer contacts api.nagios.org by default, so it no longer segfaults parsing the reply. Closes: #1119147. * Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that made every check time land in 1970 on armhf. Closes: #1123716. * Upstream 4.5.4 fixed the View Trends and View Alert Histogram links. Closes: #1063514. * Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the htdocs directory, so paths can be overridden locally. Closes: #1121618. * Make apache2 read /etc/nagios4/apache2.conf. * debian/watch: track upstream's GitHub tags, since SourceForge has carried no release since 4.5.9. * Rename 90_turn-off-use-authentication.path to .patch. * debian/rules: remove base/wpres-phash.h, include/Makefile and include/ignored_config.h in clean, so a second build in the same tree does not abort on unexpected upstream changes. Checksums-Sha1: 5ce88dfad6b8cff59c47b36fff45143c83094b95 2023 nagios4_4.5.14+ds-1.dsc 62b1ccea513d50cdd4b2f71216226d17da80ba6c 1802612 nagios4_4.5.14+ds.orig.tar.xz c47ee33c2b95e6c519e72ed7cca16da88688dc94 23860 nagios4_4.5.14+ds-1.debian.tar.xz 51abf1ad6bc6abce51ac88b05853b80c144756ed 10470 nagios4_4.5.14+ds-1_amd64.buildinfo Checksums-Sha256: d1a6916b89267b1f13b9b25e224323d8dd6651bcb615f39f9b55b89ddad736bb 2023 nagios4_4.5.14+ds-1.dsc de0633bfe18ff66cf34d00a1534a832620140b2b23802feeefab16014d55544d 1802612 nagios4_4.5.14+ds.orig.tar.xz 4f8a19055a2b4071e9e7cc8fd6fbe5c21072a10774905bd9a0b5a1eab9b693a5 23860 nagios4_4.5.14+ds-1.debian.tar.xz 95b21b380107b1eaf6752af6f83f139b5a6067377ba83b75ab70c7b5e3eb80b5 10470 nagios4_4.5.14+ds-1_amd64.buildinfo Files: d97f4df47921da61f67d659fd82d5955 2023 net optional nagios4_4.5.14+ds-1.dsc de659d5488dfb0084e0bbd21be4d1a94 1802612 net optional nagios4_4.5.14+ds.orig.tar.xz 35d4f60e430d52a29e24e2250c1874a0 23860 net optional nagios4_4.5.14+ds-1.debian.tar.xz 4e36dc84b5e8467ddc32f777a7c8e88b 10470 net optional nagios4_4.5.14+ds-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrIy1sACgkQrNSfiF5U Um5k8A//eYOSHCaksdSnnslTzdOKnaYFmEkxVt13Nq6TJuUu0o9rnJSajcPS/ykh rrZsTNEmxMujsOqpaq/uZSpD7HAftqHVzrmHkeFc+MDSjedgoSi1FawuokisWtmb brZAj6CCVRpSbt1ShCiqvBLHpEUiachSDukFrb8satUs4aOfRmDQTVZUyDWU9q4u VIg8BkQgHBpIVfYRms9ncrOBr4IP7yScN4+7quJXexVVqdzk4U6ClW5bpi7rTcFn F/DPQnTiTPRwSO8CDUApExZFrhp56wfKTwJnVN95iqcVcMtq5GERiTFS3xy/uTwR 5kh9adgAeoUuWjByJrVNq41vpr7KE5hQniUhOLvK8yyl56E8apP68VUVDZklOlIr WvwQCm+ZcTtHxpLr6wj0JelOwTnGKi7e6R7JlYI5aA1RleIrZiQ2Av4cBcBpv5lZ 8mD2VOuVglS+2Q/SxDw5dHZGaVSeM5yUPkxgu3tSGOjiwmmaNci5slvaWL9Nglb5 qdtAy6+yZ6Uf15aZ19wR3yX/66BJndIH1mDkKScMRg2iUYmYKvoh6+bd8R/rQe2N Zxwe7ypgQwKkkSMQsU/jJOBDBHmR+Jd88ytxjmiqE0LidM1eVqMVW87+wbt2EoTU ewK0lJM2Gv/Mdo1DyflcI8h8vb3uG9hzH8Ddalt8ck2HTq52+QU= =0RPa -----END PGP SIGNATURE-----
