Your message dated Fri, 09 Oct 2026 11:39:27 +0000
with message-id <[email protected]>
and subject line Bug#1119147: fixed in nagios4 4.5.14+ds-1
has caused the Debian Bug report #1119147,
regarding nagios4: Default config causes information to be sent to
api.nagios.org, which caused segfaults
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1119147: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1119147
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nagios4
Version: 4.4.6-4.1
Severity: grave
Tags: patch security
Justification: renders package unusable
X-Debbugs-Cc: Debian Security Team <[email protected]>
Dear Maintainer,
After running into segfaulting nagioses last Friday, I found that this
was caused by a combination "check_for_updates=1" in the default Debian
/etc/nagios4/nagios.cfg, and a faulty API response:
https://github.com/NagiosEnterprises/nagioscore/issues/1041
I believe this parameter should be set to 0 in the default Debian
config, as it would prevent nagios from phoning home and submitting
information. But it would also prevent nagios from crashing on bugs in
the code that handles the phoning home.
-- System Information:
Debian Release: 13.0
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.48+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages nagios4 depends on:
ii nagios4-cgi 4.4.6-4.1
ii nagios4-common 4.4.6-4.1
ii nagios4-core 4.4.6-4.1
nagios4 recommends no packages.
Versions of packages nagios4 suggests:
pn nagios-nrpe-plugin <none>
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: nagios4
Source-Version: 4.5.14+ds-1
Done: Russell Stuart <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nagios4, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Russell Stuart <[email protected]> (supplier of updated nagios4
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 31 Aug 2026 19:35:18 +1000
Source: nagios4
Architecture: source
Version: 4.5.14+ds-1
Distribution: unstable
Urgency: high
Maintainer: Russell Stuart <[email protected]>
Changed-By: Russell Stuart <[email protected]>
Closes: 1063514 1119147 1121618 1123716 1144495 1145888
Changes:
nagios4 (4.5.14+ds-1) unstable; urgency=high
.
* New upstream release (4.5.14).
* Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550),
CSRF protection bypass via a self-supplied double-submit cookie
(CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552),
authenticated RCE via custom-variable macro injection
(CVE-2026-48553) and authenticated RCE via NOTIFICATION-family
macro substitution (CVE-2026-48554). Closes: #1144495.
* Fixes the CSRF cookie bypass when no Cookie header is sent
(CVE-2026-48549). Closes: #1145888.
* The daemon no longer contacts api.nagios.org by default, so it no
longer segfaults parsing the reply. Closes: #1119147.
* Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that
made every check time land in 1970 on armhf. Closes: #1123716.
* Upstream 4.5.4 fixed the View Trends and View Alert Histogram links.
Closes: #1063514.
* Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the
htdocs directory, so paths can be overridden locally. Closes: #1121618.
* Make apache2 read /etc/nagios4/apache2.conf.
* debian/watch: track upstream's GitHub tags, since SourceForge has
carried no release since 4.5.9.
* Rename 90_turn-off-use-authentication.path to .patch.
* debian/rules: remove base/wpres-phash.h, include/Makefile and
include/ignored_config.h in clean, so a second build in the same
tree does not abort on unexpected upstream changes.
Checksums-Sha1:
5ce88dfad6b8cff59c47b36fff45143c83094b95 2023 nagios4_4.5.14+ds-1.dsc
62b1ccea513d50cdd4b2f71216226d17da80ba6c 1802612 nagios4_4.5.14+ds.orig.tar.xz
c47ee33c2b95e6c519e72ed7cca16da88688dc94 23860
nagios4_4.5.14+ds-1.debian.tar.xz
51abf1ad6bc6abce51ac88b05853b80c144756ed 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Checksums-Sha256:
d1a6916b89267b1f13b9b25e224323d8dd6651bcb615f39f9b55b89ddad736bb 2023
nagios4_4.5.14+ds-1.dsc
de0633bfe18ff66cf34d00a1534a832620140b2b23802feeefab16014d55544d 1802612
nagios4_4.5.14+ds.orig.tar.xz
4f8a19055a2b4071e9e7cc8fd6fbe5c21072a10774905bd9a0b5a1eab9b693a5 23860
nagios4_4.5.14+ds-1.debian.tar.xz
95b21b380107b1eaf6752af6f83f139b5a6067377ba83b75ab70c7b5e3eb80b5 10470
nagios4_4.5.14+ds-1_amd64.buildinfo
Files:
d97f4df47921da61f67d659fd82d5955 2023 net optional nagios4_4.5.14+ds-1.dsc
de659d5488dfb0084e0bbd21be4d1a94 1802612 net optional
nagios4_4.5.14+ds.orig.tar.xz
35d4f60e430d52a29e24e2250c1874a0 23860 net optional
nagios4_4.5.14+ds-1.debian.tar.xz
4e36dc84b5e8467ddc32f777a7c8e88b 10470 net optional
nagios4_4.5.14+ds-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrIy1sACgkQrNSfiF5U
Um5k8A//eYOSHCaksdSnnslTzdOKnaYFmEkxVt13Nq6TJuUu0o9rnJSajcPS/ykh
rrZsTNEmxMujsOqpaq/uZSpD7HAftqHVzrmHkeFc+MDSjedgoSi1FawuokisWtmb
brZAj6CCVRpSbt1ShCiqvBLHpEUiachSDukFrb8satUs4aOfRmDQTVZUyDWU9q4u
VIg8BkQgHBpIVfYRms9ncrOBr4IP7yScN4+7quJXexVVqdzk4U6ClW5bpi7rTcFn
F/DPQnTiTPRwSO8CDUApExZFrhp56wfKTwJnVN95iqcVcMtq5GERiTFS3xy/uTwR
5kh9adgAeoUuWjByJrVNq41vpr7KE5hQniUhOLvK8yyl56E8apP68VUVDZklOlIr
WvwQCm+ZcTtHxpLr6wj0JelOwTnGKi7e6R7JlYI5aA1RleIrZiQ2Av4cBcBpv5lZ
8mD2VOuVglS+2Q/SxDw5dHZGaVSeM5yUPkxgu3tSGOjiwmmaNci5slvaWL9Nglb5
qdtAy6+yZ6Uf15aZ19wR3yX/66BJndIH1mDkKScMRg2iUYmYKvoh6+bd8R/rQe2N
Zxwe7ypgQwKkkSMQsU/jJOBDBHmR+Jd88ytxjmiqE0LidM1eVqMVW87+wbt2EoTU
ewK0lJM2Gv/Mdo1DyflcI8h8vb3uG9hzH8Ddalt8ck2HTq52+QU=
=0RPa
-----END PGP SIGNATURE-----
pgp05CYpM9oMe.pgp
Description: PGP signature
--- End Message ---
