Your message dated Fri, 09 Oct 2026 11:39:28 +0000
with message-id <[email protected]>
and subject line Bug#1145888: fixed in nagios4 4.5.14+ds-1
has caused the Debian Bug report #1145888,
regarding nagios4: CVE-2026-48549
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145888: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145888
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: nagios4
Version: 4.5.12+ds-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for nagios4.
CVE-2026-48549[0]:
| Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a
| CSRF vulnerability in cmd.cgi. When no Cookie header is present, the
| double-submit cookie protection can be bypassed by supplying
| matching NagFormId and nagFormId values in the POST body, allowing a
| cross-site request to execute Nagios commands as a currently
| authenticated user.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-48549
https://www.cve.org/CVERecord?id=CVE-2026-48549
Please adjust the affected versions in the BTS as needed.
There is not much information available for this CVE, sait to be fixed
in 4.5.13.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: nagios4
Source-Version: 4.5.14+ds-1
Done: Russell Stuart <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nagios4, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Russell Stuart <[email protected]> (supplier of updated nagios4
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 19:35:18 +1000
Source: nagios4
Architecture: source
Version: 4.5.14+ds-1
Distribution: unstable
Urgency: high
Maintainer: Russell Stuart <[email protected]>
Changed-By: Russell Stuart <[email protected]>
Closes: 1063514 1119147 1121618 1123716 1144495 1145888
Changes:
nagios4 (4.5.14+ds-1) unstable; urgency=high
.
* New upstream release (4.5.14).
* Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550),
CSRF protection bypass via a self-supplied double-submit cookie
(CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552),
authenticated RCE via custom-variable macro injection
(CVE-2026-48553) and authenticated RCE via NOTIFICATION-family
macro substitution (CVE-2026-48554). Closes: #1144495.
* Fixes the CSRF cookie bypass when no Cookie header is sent
(CVE-2026-48549). Closes: #1145888.
* The daemon no longer contacts api.nagios.org by default, so it no
longer segfaults parsing the reply. Closes: #1119147.
* Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that
made every check time land in 1970 on armhf. Closes: #1123716.
* Upstream 4.5.4 fixed the View Trends and View Alert Histogram links.
Closes: #1063514.
* Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the
htdocs directory, so paths can be overridden locally. Closes: #1121618.
* Make apache2 read /etc/nagios4/apache2.conf.
* debian/watch: track upstream's GitHub tags, since SourceForge has
carried no release since 4.5.9.
* Rename 90_turn-off-use-authentication.path to .patch.
* debian/rules: remove base/wpres-phash.h, include/Makefile and
include/ignored_config.h in clean, so a second build in the same
tree does not abort on unexpected upstream changes.
Checksums-Sha1:
5ce88dfad6b8cff59c47b36fff45143c83094b95 2023 nagios4_4.5.14+ds-1.dsc
62b1ccea513d50cdd4b2f71216226d17da80ba6c 1802612 nagios4_4.5.14+ds.orig.tar.xz
c47ee33c2b95e6c519e72ed7cca16da88688dc94 23860
nagios4_4.5.14+ds-1.debian.tar.xz
51abf1ad6bc6abce51ac88b05853b80c144756ed 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Checksums-Sha256:
d1a6916b89267b1f13b9b25e224323d8dd6651bcb615f39f9b55b89ddad736bb 2023
nagios4_4.5.14+ds-1.dsc
de0633bfe18ff66cf34d00a1534a832620140b2b23802feeefab16014d55544d 1802612
nagios4_4.5.14+ds.orig.tar.xz
4f8a19055a2b4071e9e7cc8fd6fbe5c21072a10774905bd9a0b5a1eab9b693a5 23860
nagios4_4.5.14+ds-1.debian.tar.xz
95b21b380107b1eaf6752af6f83f139b5a6067377ba83b75ab70c7b5e3eb80b5 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Files:
d97f4df47921da61f67d659fd82d5955 2023 net optional nagios4_4.5.14+ds-1.dsc
de659d5488dfb0084e0bbd21be4d1a94 1802612 net optional
nagios4_4.5.14+ds.orig.tar.xz
35d4f60e430d52a29e24e2250c1874a0 23860 net optional
nagios4_4.5.14+ds-1.debian.tar.xz
4e36dc84b5e8467ddc32f777a7c8e88b 10470 net optional
nagios4_4.5.14+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrIy1sACgkQrNSfiF5U
Um5k8A//eYOSHCaksdSnnslTzdOKnaYFmEkxVt13Nq6TJuUu0o9rnJSajcPS/ykh
rrZsTNEmxMujsOqpaq/uZSpD7HAftqHVzrmHkeFc+MDSjedgoSi1FawuokisWtmb
brZAj6CCVRpSbt1ShCiqvBLHpEUiachSDukFrb8satUs4aOfRmDQTVZUyDWU9q4u
VIg8BkQgHBpIVfYRms9ncrOBr4IP7yScN4+7quJXexVVqdzk4U6ClW5bpi7rTcFn
F/DPQnTiTPRwSO8CDUApExZFrhp56wfKTwJnVN95iqcVcMtq5GERiTFS3xy/uTwR
5kh9adgAeoUuWjByJrVNq41vpr7KE5hQniUhOLvK8yyl56E8apP68VUVDZklOlIr
WvwQCm+ZcTtHxpLr6wj0JelOwTnGKi7e6R7JlYI5aA1RleIrZiQ2Av4cBcBpv5lZ
8mD2VOuVglS+2Q/SxDw5dHZGaVSeM5yUPkxgu3tSGOjiwmmaNci5slvaWL9Nglb5
qdtAy6+yZ6Uf15aZ19wR3yX/66BJndIH1mDkKScMRg2iUYmYKvoh6+bd8R/rQe2N
Zxwe7ypgQwKkkSMQsU/jJOBDBHmR+Jd88ytxjmiqE0LidM1eVqMVW87+wbt2EoTU
ewK0lJM2Gv/Mdo1DyflcI8h8vb3uG9hzH8Ddalt8ck2HTq52+QU=
=0RPa
-----END PGP SIGNATURE-----
pgpll7qu48suD.pgp
Description: PGP signature
--- End Message ---
