Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package nagios for openSUSE:Factory checked in at 2026-10-05 15:46:58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/nagios (Old) and /work/SRC/openSUSE:Factory/.nagios.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "nagios" Mon Oct 5 15:46:58 2026 rev:34 rq:1382468 version:4.5.14 Changes: -------- --- /work/SRC/openSUSE:Factory/nagios/nagios.changes 2026-08-18 17:16:59.909477049 +0200 +++ /work/SRC/openSUSE:Factory/.nagios.new.3698736/nagios.changes 2026-10-05 15:47:07.563311267 +0200 @@ -1,0 +2,15 @@ +Wed Sep 30 07:10:30 UTC 2026 - Ansgar Esztermann <[email protected]> + +- update to 4.5.14 + * Fix vulnerabilities in notification macros, which are now being sanitized (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) + * Fix vulnerabilities in jsonquery.js (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) + * Fix reflected XSS in cmd.cgi (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) + * Fix vulnerabilities in CSRF cookie (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) + * Fix an issue where a last check time in the future would stop checks from running (Doug Nazar) + +- changes from 4.5.13 + * Add cgi_cookie_fail_open config option that allows for third-party integrations to use cmd.cgi (Emmett Kapsner) + * Fix vulnerabilities in CSRF cookie in cmd.cgi (Thanks SeungMyung Lee) (Emmett Kapsner) + * Fix vulnerabilities in custom variables and add missing sanitization (Thanks Gabriel "Texugo" Rodrigues) (Emmett Kapsner) + +------------------------------------------------------------------- Old: ---- nagios-4.5.12.tar.gz New: ---- nagios-4.5.14.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ nagios.spec ++++++ --- /var/tmp/diff_new_pack.icXWHm/_old 2026-10-05 15:47:09.151377688 +0200 +++ /var/tmp/diff_new_pack.icXWHm/_new 2026-10-05 15:47:09.157377939 +0200 @@ -32,7 +32,7 @@ %endif Name: nagios -Version: 4.5.12 +Version: 4.5.14 Release: 0 Summary: The Nagios Network Monitor License: GPL-2.0-or-later ++++++ _service ++++++ --- /var/tmp/diff_new_pack.icXWHm/_old 2026-10-05 15:47:09.248381745 +0200 +++ /var/tmp/diff_new_pack.icXWHm/_new 2026-10-05 15:47:09.254381996 +0200 @@ -2,7 +2,7 @@ <service name="download_url" mode="localonly"> <param name="host">github.com</param> <param name="protocol">https</param> - <param name="path">/NagiosEnterprises/nagioscore/releases/download/nagios-4.5.12/nagios-4.5.12.tar.gz</param> + <param name="path">/NagiosEnterprises/nagioscore/releases/download/nagios-4.5.14/nagios-4.5.14.tar.gz</param> </service> </services> ++++++ nagios-4.5.12.tar.gz -> nagios-4.5.14.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/Changelog new/nagios-4.5.14/Changelog --- old/nagios-4.5.12/Changelog 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/Changelog 2026-08-05 16:54:35.000000000 +0200 @@ -2,6 +2,20 @@ Nagios Core 4 Change Log ######################## +4.5.14 - 2026-08-05 +------------------- +* Fix vulnerabilities in notification macros, which are now being sanitized (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) +* Fix vulnerabilities in jsonquery.js (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) +* Fix reflected XSS in cmd.cgi (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) +* Fix vulnerabilities in CSRF cookie (Thanks Zach Hanley of Horizon3.ai) (Emmett Kapsner) +* Fix an issue where a last check time in the future would stop checks from running (Doug Nazar) + +4.5.13 - 2026-05-28 +------------------- +* Add cgi_cookie_fail_open config option that allows for third-party integrations to use cmd.cgi (Emmett Kapsner) +* Fix vulnerabilities in CSRF cookie in cmd.cgi (Thanks SeungMyung Lee) (Emmett Kapsner) +* Fix vulnerabilities in custom variables and add missing sanitization (Thanks Gabriel "Texugo" Rodrigues) (Emmett Kapsner) + 4.5.12 - 2026-03-25 ------------------- * Fix vulnerabilities in CSRF cookie (Thanks SeungMyung Lee) (Emmett Kapsner) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/THANKS new/nagios-4.5.14/THANKS --- old/nagios-4.5.12/THANKS 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/THANKS 2026-08-05 16:54:35.000000000 +0200 @@ -106,7 +106,8 @@ * Fran Boon * Franky Van Liedekerke * Frederic Schaer -* Frederic Van Espen +* Frederic Van Espen +* Gabriel "Texugo" Rodrigues * Gareth Randall * Garry Cook * Gary Berger diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/base/checks.c new/nagios-4.5.14/base/checks.c --- old/nagios-4.5.12/base/checks.c 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/base/checks.c 2026-08-05 16:54:35.000000000 +0200 @@ -1699,7 +1699,7 @@ /* we may have to nudge this check a bit */ if (options == CHECK_OPTION_DEPENDENCY_CHECK) { - if (svc->last_check + cached_service_check_horizon > check_time) { + if (svc->last_check <= time(NULL) && svc->last_check + cached_service_check_horizon > check_time) { log_debug_info(DEBUGL_CHECKS, 0, "Last check result is recent enough (%s)", ctime(&svc->last_check)); return; } @@ -3122,12 +3122,14 @@ /* abort if check is already running or was recently completed */ if (!(check_options & CHECK_OPTION_FORCE_EXECUTION)) { + time_t current_time = time(NULL); + if (hst->is_executing == TRUE) { log_debug_info(DEBUGL_CHECKS, 1, "A check of this host is already being executed, so we'll pass for the moment...\n"); return ERROR; } - if (hst->last_check + cached_host_check_horizon > time(NULL)) { + if (hst->last_check <= current_time && hst->last_check + cached_host_check_horizon > current_time) { log_debug_info(DEBUGL_CHECKS, 0, "Host '%s' was last checked within its cache horizon. Aborting check\n", hst->name); return ERROR; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/cgi/cgiutils.c new/nagios-4.5.14/cgi/cgiutils.c --- old/nagios-4.5.12/cgi/cgiutils.c 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/cgi/cgiutils.c 2026-08-05 16:54:35.000000000 +0200 @@ -72,6 +72,7 @@ int ack_no_sticky = FALSE; int ack_no_send = FALSE; int tac_cgi_hard_only = FALSE; +int cgi_cookie_fail_open = FALSE; time_t this_scheduled_log_rotation = 0L; time_t last_scheduled_log_rotation = 0L; @@ -443,6 +444,8 @@ ack_no_send = (atoi(val) > 0) ? TRUE : FALSE; else if(!strcmp(var, "tac_cgi_hard_only")) tac_cgi_hard_only = (atoi(val) > 0) ? TRUE : FALSE; + else if (!strcmp(var, "cgi_cookie_fail_open")) + cgi_cookie_fail_open = (atoi(val) > 0) ? TRUE : FALSE; else if (callback) (*callback)(var,val); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/cgi/cmd.c new/nagios-4.5.14/cgi/cmd.c --- old/nagios-4.5.12/cgi/cmd.c 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/cgi/cmd.c 2026-08-05 16:54:35.000000000 +0200 @@ -44,6 +44,7 @@ extern int ack_no_sticky; extern int ack_no_send; +extern int cgi_cookie_fail_open; #define MAX_AUTHOR_LENGTH 64 #define MAX_COMMENT_LENGTH 1024 @@ -112,7 +113,6 @@ int main(void) { int result = OK; - int formid_ok = ERROR; /* Initialize shared configuration variables */ init_shared_cfg_vars(1); @@ -218,6 +218,8 @@ return OK; } + int formid_ok = cgi_cookie_fail_open ? OK : ERROR; + if (cookie_form_id && *cookie_form_id) { if (form_id && *form_id) { if (!strcmp(form_id, cookie_form_id)) @@ -293,7 +295,7 @@ exit(1); } - printf("Set-Cookie: NagFormId=%s; SameSite=Strict\r\n", cookie_form_id); + printf("Set-Cookie: NagFormId=%s; SameSite=Strict; HttpOnly\r\n", cookie_form_id); } } @@ -714,6 +716,7 @@ } cookie_form_id = (char*)strdup(variables[x]); + strip_html_brackets(cookie_form_id); } /* we found the form id on the form */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/cgi/getcgi.c new/nagios-4.5.14/cgi/getcgi.c --- old/nagios-4.5.12/cgi/getcgi.c 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/cgi/getcgi.c 2026-08-05 16:54:35.000000000 +0200 @@ -222,6 +222,13 @@ paircount = 0; nvpair = strtok(cgiinput, "&"); while(nvpair) { + unescape_cgi_input(nvpair); + + /* NagFormId must come from a cookie - skip any attempt to set it by other means */ + if (strncmp(nvpair, "NagFormId=", 10) == 0){ /* 10 is the length of NagFormId= */ + nvpair = strtok(NULL, "&"); + continue; + } pairlist[paircount] = strdup(nvpair); if( NULL == pairlist[paircount]) { printf("getcgivars(): Could not allocate memory for name-value pair #%d.\n", paircount); @@ -291,7 +298,6 @@ printf("getcgivars(): Could not allocate memory for cgi value #%d.\n", i); exit(1); } - unescape_cgi_input(cgivars[i * 2 + 1]); } else { cgivars[i * 2 + 1] = strdup(""); @@ -299,7 +305,6 @@ printf("getcgivars(): Could not allocate memory for empty stringfor variable value #%d.\n", i); exit(1); } - unescape_cgi_input(cgivars[i * 2 + 1]); } /* get the variable value (or name/value of there was no real "pair" in the first place) */ @@ -308,7 +313,6 @@ printf("getcgivars(): Could not allocate memory for cgi name #%d.\n", i); exit(1); } - unescape_cgi_input(cgivars[i * 2]); } /* terminate the name-value list */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/common/macros.c new/nagios-4.5.14/common/macros.c --- old/nagios-4.5.12/common/macros.c 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/common/macros.c 2026-08-05 16:54:35.000000000 +0200 @@ -636,6 +636,11 @@ /* get the macro value */ result = grab_custom_macro_value_r(mac, macro_name, arg[0], arg[1], output); + + /* always strip illegal characters from custom macros */ + if (clean_options){ + *clean_options |= STRIP_ILLEGAL_MACRO_CHARS; + } } /* no macro matched... */ @@ -2663,6 +2668,10 @@ case MACRO_SERVICEPERFDATA: case MACRO_SERVICEACKAUTHOR: case MACRO_SERVICEACKCOMMENT: + case MACRO_NOTIFICATIONAUTHOR: + case MACRO_NOTIFICATIONAUTHORNAME: + case MACRO_NOTIFICATIONAUTHORALIAS: + case MACRO_NOTIFICATIONCOMMENT: macro_keys[x].options |= STRIP_ILLEGAL_MACRO_CHARS | ESCAPE_MACRO_CHARS; break; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/configure new/nagios-4.5.14/configure --- old/nagios-4.5.12/configure 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/configure 2026-08-05 16:54:35.000000000 +0200 @@ -2878,9 +2878,9 @@ PKG_NAME=nagios -PKG_VERSION="4.5.12" +PKG_VERSION="4.5.14" PKG_HOME_URL="https://www.nagios.org/"; -PKG_REL_DATE="2026-03-25" +PKG_REL_DATE="2026-08-05" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/configure.ac new/nagios-4.5.14/configure.ac --- old/nagios-4.5.12/configure.ac 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/configure.ac 2026-08-05 16:54:35.000000000 +0200 @@ -12,9 +12,9 @@ PKG_NAME=nagios -PKG_VERSION="4.5.12" +PKG_VERSION="4.5.14" PKG_HOME_URL="https://www.nagios.org/"; -PKG_REL_DATE="2026-03-25" +PKG_REL_DATE="2026-08-05" dnl Figure out how to invoke "install" and what install options to use. AC_PROG_INSTALL diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/contrib/epel-nagios.spec new/nagios-4.5.14/contrib/epel-nagios.spec --- old/nagios-4.5.12/contrib/epel-nagios.spec 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/contrib/epel-nagios.spec 2026-08-05 16:54:35.000000000 +0200 @@ -3,7 +3,7 @@ %global bootstrap 0 Name: nagios -Version: 4.5.12 +Version: 4.5.14 Release: 4%{?dist} Summary: Host/service/network monitoring program diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/doxy.conf new/nagios-4.5.14/doxy.conf --- old/nagios-4.5.12/doxy.conf 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/doxy.conf 2026-08-05 16:54:35.000000000 +0200 @@ -1,5 +1,5 @@ PROJECT_NAME = Nagios -PROJECT_NUMBER = 4.5.12 +PROJECT_NUMBER = 4.5.14 PROJECT_BRIEF = "Dev docs for Nagios core and neb-module hackers" INPUT = lib/ docs/ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/html/js/jsonquery.js new/nagios-4.5.14/html/js/jsonquery.js --- old/nagios-4.5.12/html/js/jsonquery.js 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/html/js/jsonquery.js 2026-08-05 16:54:35.000000000 +0200 @@ -554,7 +554,7 @@ parameters, function(data, results) { $('#results').append( - $('<p></p>').html( objectToString( 0, data)) + $('<pre></pre>').text( JSON.stringify(data, null, 2)) ); } ); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/html/main.php new/nagios-4.5.14/html/main.php --- old/nagios-4.5.12/html/main.php 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/html/main.php 2026-08-05 16:54:35.000000000 +0200 @@ -1,7 +1,7 @@ <?php include_once(dirname(__FILE__).'/includes/utils.inc.php'); -$this_version = '4.5.12'; +$this_version = '4.5.14'; $this_year = '2026'; $theme = isset($cfg['theme']) ? $cfg['theme'] : 'dark'; if ($theme != 'dark' && $theme != 'light') { @@ -72,7 +72,7 @@ <div id="currentversioninfo"> <div> <div class="version">Version <b><?php echo $this_version; ?></b></div> - <div class="releasedate">March 25, 2026</div> + <div class="releasedate">August 05, 2026</div> </div> <div><span id="core-status"></span></div> <a class="checkforupdates" href="https://www.nagios.org/checkforupdates/?version=<?php echo $this_version; ?>&product=nagioscore" target="_blank">Check for updates</a> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/html/side.php new/nagios-4.5.14/html/side.php --- old/nagios-4.5.12/html/side.php 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/html/side.php 2026-08-05 16:54:35.000000000 +0200 @@ -1,7 +1,7 @@ <?php include_once(dirname(__FILE__).'/includes/utils.inc.php'); -$this_version = '4.5.12'; +$this_version = '4.5.14'; $link_target = 'main'; $theme = isset($cfg['theme']) ? $cfg['theme'] : 'dark'; if ($theme != 'dark' && $theme != 'light') { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/include/common.h new/nagios-4.5.14/include/common.h --- old/nagios-4.5.12/include/common.h 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/include/common.h 2026-08-05 16:54:35.000000000 +0200 @@ -24,8 +24,8 @@ #include "shared.h" -#define PROGRAM_VERSION "4.5.12" -#define PROGRAM_MODIFICATION_DATE "2026-03-25" +#define PROGRAM_VERSION "4.5.14" +#define PROGRAM_MODIFICATION_DATE "2026-08-05" NAGIOS_BEGIN_DECL diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/nagios.spec new/nagios-4.5.14/nagios.spec --- old/nagios-4.5.12/nagios.spec 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/nagios.spec 2026-08-05 16:54:35.000000000 +0200 @@ -29,7 +29,7 @@ Summary: Open Source host, service and network monitoring program Name: nagios -Version: 4.5.12 +Version: 4.5.14 Release: 2%{?dist} License: GPL Group: Applications/System diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/sample-config/cgi.cfg.in new/nagios-4.5.14/sample-config/cgi.cfg.in --- old/nagios-4.5.12/sample-config/cgi.cfg.in 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/sample-config/cgi.cfg.in 2026-08-05 16:54:35.000000000 +0200 @@ -404,6 +404,21 @@ +# CGI CSRF COOKIE CHECK BEHAVIOR +# This option controls how the CGI handles a missing CSRF Cookie. +# 0 (default): Fail closed - reject the request if the CSRF cookie is +# missing or invalid. This is more secure. +# 1: Fail open - allow the request even if the CSRF cookie check fails. +# This reduces CSRF protection but may be required for some third-party +# integrations. +# +# WARNING: Enabling fail open weakens security and should only be used +# if you fully understand the risk. + +#cgi_cookie_fail_open=0 + + + # COMMAND COMMENTS # These options control whether or not comments are required, optional, # or not allowed for specific commands. The format for each line is: diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/sample-config/nagios.cfg.in new/nagios-4.5.14/sample-config/nagios.cfg.in --- old/nagios-4.5.12/sample-config/nagios.cfg.in 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/sample-config/nagios.cfg.in 2026-08-05 16:54:35.000000000 +0200 @@ -1130,7 +1130,7 @@ # This option allows you to specify illegal characters that are # stripped from macros before being used in notifications, event # handlers, etc. This DOES NOT affect macros used in service or -# host check commands. +# host check commands with the exemption of custom variables. # The following macros are stripped of the characters you specify: # $HOSTOUTPUT$ # $LONGHOSTOUTPUT$ @@ -1142,6 +1142,10 @@ # $SERVICEPERFDATA$ # $SERVICEACKAUTHOR$ # $SERVICEACKCOMMENT$ +# $NOTIFICATIONAUTHOR$ +# $NOTIFICATIONAUTHORNAME$ +# $NOTIFICATIONAUTHORALIAS$ +# $NOTIFICATIONCOMMENT$ illegal_macro_output_chars=`~$&|'"<> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/startup/default-service.in new/nagios-4.5.14/startup/default-service.in --- old/nagios-4.5.12/startup/default-service.in 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/startup/default-service.in 2026-08-05 16:54:35.000000000 +0200 @@ -1,5 +1,5 @@ [Unit] -Description=Nagios Core 4.5.12 +Description=Nagios Core 4.5.14 Documentation=https://www.nagios.org/documentation After=network.target local-fs.target diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/nagios-4.5.12/update-version new/nagios-4.5.14/update-version --- old/nagios-4.5.12/update-version 2026-03-25 15:20:42.000000000 +0100 +++ new/nagios-4.5.14/update-version 2026-08-05 16:54:35.000000000 +0200 @@ -12,10 +12,10 @@ fi # Current version number -CURRENTVERSION=4.5.12 +CURRENTVERSION=4.5.14 # Last date -LASTDATE=2026-03-25 +LASTDATE=2026-08-05 if [ "x$1" = "x" ] then
