-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 31 Aug 2026 19:56:29 +1000 Source: nagios4 Architecture: source Version: 4.4.6-4.1+deb13u2 Distribution: trixie-security Urgency: high Maintainer: Russell Stuart <[email protected]> Changed-By: Russell Stuart <[email protected]> Changes: nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high . * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now tracked as CVE-2026-48548. * Backport upstream 4.5.13 and 4.5.14 security fixes: - CSRF protection bypass in cmd.cgi, where a request sending no Cookie header could supply both halves of the double-submit cookie itself (CVE-2026-48549). - Reflected XSS in cmd.cgi via the NagFormId parameter (CVE-2026-48550). - CSRF protection bypass via a self-supplied double-submit cookie (CVE-2026-48551). - DOM-based XSS in jsonquery.js (CVE-2026-48552). - Authenticated remote code execution via custom-variable macro injection (CVE-2026-48553). - Authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution (CVE-2026-48554). * Fix a one-element heap overflow in getcgivars() when a request with no parameters carries a NagFormId cookie. No CVE assigned. Checksums-Sha1: 87100cd432ff72bd40817dfbc0830416c2f9b2fb 2018 nagios4_4.4.6-4.1+deb13u2.dsc adba297297b3e861d49c75a4697b587375b9b374 1100028 nagios4_4.4.6-4.1+deb13u2.debian.tar.xz bea7b748a3308298a7646ebc50f8888a3b30bbc3 10991 nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo Checksums-Sha256: 8bd8a38e222f19a60cb16e085671917a784b9d2bdc892b60088f82e17aedda72 2018 nagios4_4.4.6-4.1+deb13u2.dsc f2b0759f843c2e5517e46c3f90f9f427d33737de18986f6b05c0b4839988717e 1100028 nagios4_4.4.6-4.1+deb13u2.debian.tar.xz d76e42f94048dbee44c6b399fda3f0bd95a75362d8fd4c0ef2a02f50325c5fe8 10991 nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo Files: 9cfd802db937ebca91aecc4e6f4411a8 2018 net optional nagios4_4.4.6-4.1+deb13u2.dsc 7d60678aab9fb2ce9e5f3af866d000a6 1100028 net optional nagios4_4.4.6-4.1+deb13u2.debian.tar.xz ec85ba0f42c561b20beb17948083d5bd 10991 net optional nagios4_4.4.6-4.1+deb13u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEZqiOeH6lCkTWvjmorNSfiF5UUm4FAmrK4c0ACgkQrNSfiF5U Um5aKg//bNFn5+fawP3XNZyoaxGyu26uSDWLcygRhTDLrxkbPzdxgjvEbge98KAV pF/KHkxaTJQ8bUObBUX5IXaF7Dl1BWPg/SxlPhWjlql+P2ltXc5ke4Uwv1w9TZTP VM3xjrv7+0JkqCxk42FqDvb+vJ7D/RivJ4A4z1+r8T2Sv4vzb0p7MeajLJVv6JkZ kNHb9MeRLoWlQ+xJymRdKxe4/dIQEAAGS9oTny89x6yfE6zTb41nHRGzrRbQEmFx 4I7gfnJEHGt6bfj2/9Iexe0MdJvZYCVhqWBgaJkFTNiFAVVhRUl9WTq0892SveaL aIgR6jZjtz6+HEmrKa3LwOunr317rp4kfrAH2nBuEafxrP0tenAXuYObecCr2qBH 9063bdJK6PTcRCLRpcE/8VNsYraeaDBs+/1YTUTO+CVKCy/keTLUvSh4wDRusGxj 9RO2hVCPvSzXz+g8HV2f+guf4rgnLbvbAkESShU3t5z6KTbCJpgsjGZSx5aqKNxO fbG8Ti+6rNVl8yGwT6QJndiPb1FLwRlNNGkadpUv2X38Ey+6jcTUSOGSOt/ust/6 GDzvBruy4tMRGnJt+941n/prY3qRvC6e7iS0hZZhDCamIaqQ5+6TDnlmqSK89waj 1SoAtix/hqOGU5OT2wJ3r1skKFH8gku1pTyi3drOw9Tw43eyYO4= =h42Z -----END PGP SIGNATURE-----
pgpmgAleWK4_d.pgp
Description: PGP signature
