-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 19:56:29 +1000
Source: nagios4
Architecture: source
Version: 4.4.6-4.1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Russell Stuart <russell-debian@stuart.id.au>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Changes:
nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high
.
* The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now
tracked as CVE-2026-48548.
* Backport upstream 4.5.13 and 4.5.14 security fixes:
- CSRF protection bypass in cmd.cgi, where a request sending no
Cookie header could supply both halves of the double-submit
cookie itself (CVE-2026-48549).
- Reflected XSS in cmd.cgi via the NagFormId parameter
(CVE-2026-48550).
- CSRF protection bypass via a self-supplied double-submit cookie
(CVE-2026-48551).
- DOM-based XSS in jsonquery.js (CVE-2026-48552).
- Authenticated remote code execution via custom-variable macro
injection (CVE-2026-48553).
- Authenticated remote code execution via unfiltered
NOTIFICATION-family macro substitution (CVE-2026-48554).
* Fix a one-element heap overflow in getcgivars() when a request with
no parameters carries a NagFormId cookie. No CVE assigned.
Checksums-Sha1:
87100cd432ff72bd40817dfbc0830416c2f9b2fb 2018 nagios4_4.4.6-4.1+deb13u2.dsc
adba297297b3e861d49c75a4697b587375b9b374 1100028 nagios4_4.4.6-4.1+deb13u2.debian.tar.xz
bea7b748a3308298a7646ebc50f8888a3b30bbc3 10991 nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo
Checksums-Sha256:
8bd8a38e222f19a60cb16e085671917a784b9d2bdc892b60088f82e17aedda72 2018 nagios4_4.4.6-4.1+deb13u2.dsc
f2b0759f843c2e5517e46c3f90f9f427d33737de18986f6b05c0b4839988717e 1100028 nagios4_4.4.6-4.1+deb13u2.debian.tar.xz
d76e42f94048dbee44c6b399fda3f0bd95a75362d8fd4c0ef2a02f50325c5fe8 10991 nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo
Files:
9cfd802db937ebca91aecc4e6f4411a8 2018 net optional nagios4_4.4.6-4.1+deb13u2.dsc
7d60678aab9fb2ce9e5f3af866d000a6 1100028 net optional nagios4_4.4.6-4.1+deb13u2.debian.tar.xz
ec85ba0f42c561b20beb17948083d5bd 10991 net optional nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrK4c0ACgkQrNSfiF5U
Um5aKg//bNFn5+fawP3XNZyoaxGyu26uSDWLcygRhTDLrxkbPzdxgjvEbge98KAV
pF/KHkxaTJQ8bUObBUX5IXaF7Dl1BWPg/SxlPhWjlql+P2ltXc5ke4Uwv1w9TZTP
VM3xjrv7+0JkqCxk42FqDvb+vJ7D/RivJ4A4z1+r8T2Sv4vzb0p7MeajLJVv6JkZ
kNHb9MeRLoWlQ+xJymRdKxe4/dIQEAAGS9oTny89x6yfE6zTb41nHRGzrRbQEmFx
4I7gfnJEHGt6bfj2/9Iexe0MdJvZYCVhqWBgaJkFTNiFAVVhRUl9WTq0892SveaL
aIgR6jZjtz6+HEmrKa3LwOunr317rp4kfrAH2nBuEafxrP0tenAXuYObecCr2qBH
9063bdJK6PTcRCLRpcE/8VNsYraeaDBs+/1YTUTO+CVKCy/keTLUvSh4wDRusGxj
9RO2hVCPvSzXz+g8HV2f+guf4rgnLbvbAkESShU3t5z6KTbCJpgsjGZSx5aqKNxO
fbG8Ti+6rNVl8yGwT6QJndiPb1FLwRlNNGkadpUv2X38Ey+6jcTUSOGSOt/ust/6
GDzvBruy4tMRGnJt+941n/prY3qRvC6e7iS0hZZhDCamIaqQ5+6TDnlmqSK89waj
1SoAtix/hqOGU5OT2wJ3r1skKFH8gku1pTyi3drOw9Tw43eyYO4=
=h42Z
-----END PGP SIGNATURE-----
