-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Architecture: source
Version: 4.4.6-4+deb12u2
Distribution: bookworm-security
Urgency: high
Maintainer: Russell Stuart <russell-debian@stuart.id.au>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Changes:
nagios4 (4.4.6-4+deb12u2) bookworm-security; urgency=high
.
* The CSRF fix previously backported in 4.4.6-4+deb12u1 is now
tracked as CVE-2026-48548.
* Backport upstream 4.5.13 and 4.5.14 security fixes:
- CSRF protection bypass in cmd.cgi, where a request sending no
Cookie header could supply both halves of the double-submit
cookie itself (CVE-2026-48549).
- Reflected XSS in cmd.cgi via the NagFormId parameter
(CVE-2026-48550).
- CSRF protection bypass via a self-supplied double-submit cookie
(CVE-2026-48551).
- DOM-based XSS in jsonquery.js (CVE-2026-48552).
- Authenticated remote code execution via custom-variable macro
injection (CVE-2026-48553).
- Authenticated remote code execution via unfiltered
NOTIFICATION-family macro substitution (CVE-2026-48554).
* Fix a one-element heap overflow in getcgivars() when a request with
no parameters carries a NagFormId cookie. No CVE assigned.
Checksums-Sha1:
40304ecb6390adff5ae22d75472e5ef59783f9d5 2010 nagios4_4.4.6-4+deb12u2.dsc
e129fc40e47d73267d2af6e699003479c83adaef 1099924 nagios4_4.4.6-4+deb12u2.debian.tar.xz
90c0298eeb0cae1d0df24c832f32e6b3de2bede9 11188 nagios4_4.4.6-4+deb12u2_amd64.buildinfo
Checksums-Sha256:
41e52089c2aab59d94e393d73cf29897fea06fae412c2c67c7ef8bd4d883e54d 2010 nagios4_4.4.6-4+deb12u2.dsc
07a2b6a9a61b8ed3459f03d20fe03b75094993199412c809b58add92ac7b44fc 1099924 nagios4_4.4.6-4+deb12u2.debian.tar.xz
8ab60adbab02ff2aeea628da9123cf11034618a6230a538547c26af55576a13a 11188 nagios4_4.4.6-4+deb12u2_amd64.buildinfo
Files:
1e223b6b7b3f35a2c8c115233a169d76 2010 net optional nagios4_4.4.6-4+deb12u2.dsc
9a57a6e10bebf7c0b086779bbcca5a53 1099924 net optional nagios4_4.4.6-4+deb12u2.debian.tar.xz
1d2e16171a7c7475783fcf3f15207bcc 11188 net optional nagios4_4.4.6-4+deb12u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrIzoIACgkQrNSfiF5U
Um7tig//UbLctAsGWimjwJ2ClomhalsfD0Q1aOVi+sqWH4CU4f0Q02JqEkYDN/dr
izwU8KodhuPNSFnporgzVh2DkBKnmHmZEHxRhadNlkWW1DpDN+lzJ25vi/svLL7o
zWB4VfJtA7ME84ZTFtyPTOi3OE555ONIO0ax3duFGYmTid/s6VmwkUwj8jWvzsE/
SKiyjnPfGX13gn7kf7KkV9eOaOcz4wBxGuvUjW6NyZaO864xIs8Q8VQoSBYtBFyp
TJ0oURDVefzfwYcvscn8mQToOU6DhC1qZe3nFG2Wcjp5k7Xmz38c49tjkxXPHggW
D0UlSCI/KBvaVIIWC7TzZqpXFaWH0OcVf7mB0nDBOSk0x5o7WEh2/imGampNS+hU
nEIxnsTVyCJ6YFq+plaEufHR1fU91FVn6Ijx2otal4OVvYflCHoOaypwULlCeXmI
CFEwDYbUXToasA4tKMyvDWJEKMcL/cejHd5F/cdWqxJ39EYFnp9r9loKfmeI1IkH
CVbIBGzaWAvLn8qJMz0VxbtAzk3Hpy59+qr038Avaggj+BH4/1sUEuXEfwX3/L8K
l0zYGcWfgkE/u2xsDy/QLBuFYXgpV6l7+Smn0xnhxXnkg0SdJzjXHwXLfeFKK7Un
wr3OPwxAq44yWGgt6w6SiPfWAGD1F/pZVHqbSvV+6L/WFRy5AuM=
=QY5z
-----END PGP SIGNATURE-----
