From foo@bar  Fri Oct  9 20:20:07 2026
Format: 1.8
Date: Mon, 31 Aug 2026 19:35:18 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: alpha
Version: 4.5.14+ds-1
Distribution: sid
Urgency: high
Maintainer: alpha Build Daemon (alpha-sc-03) <alpha-sc-03@alpha-sc-03.buildd.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Closes: 1063514 1119147 1121618 1123716 1144495 1145888
Changes:
 nagios4 (4.5.14+ds-1) unstable; urgency=high
 .
   * New upstream release (4.5.14).
   * Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550),
     CSRF protection bypass via a self-supplied double-submit cookie
     (CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552),
     authenticated RCE via custom-variable macro injection
     (CVE-2026-48553) and authenticated RCE via NOTIFICATION-family
     macro substitution (CVE-2026-48554).  Closes: #1144495.
   * Fixes the CSRF cookie bypass when no Cookie header is sent
     (CVE-2026-48549).  Closes: #1145888.
   * The daemon no longer contacts api.nagios.org by default, so it no
     longer segfaults parsing the reply.  Closes: #1119147.
   * Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that
     made every check time land in 1970 on armhf.  Closes: #1123716.
   * Upstream 4.5.4 fixed the View Trends and View Alert Histogram links.
     Closes: #1063514.
   * Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the
     htdocs directory, so paths can be overridden locally.  Closes: #1121618.
   * Make apache2 read /etc/nagios4/apache2.conf.
   * debian/watch: track upstream's GitHub tags, since SourceForge has
     carried no release since 4.5.9.
   * Rename 90_turn-off-use-authentication.path to .patch.
   * debian/rules: remove base/wpres-phash.h, include/Makefile and
     include/ignored_config.h in clean, so a second build in the same
     tree does not abort on unexpected upstream changes.
Checksums-Sha1:
 c21ef92733ddeed597f512f736bf531e1c1cdb15 5762840 nagios4-cgi-dbgsym_4.5.14+ds-1_alpha.deb
 1a9be7fb0860a165fe69ec543f55c7c6ed6fb9d2 1071420 nagios4-cgi_4.5.14+ds-1_alpha.deb
 f7d10b9fffeb28afd51a99746dbfd249c82e25ce 746880 nagios4-core-dbgsym_4.5.14+ds-1_alpha.deb
 c383dc339fe5cc6f0732f3697d188bace1ce39a3 234828 nagios4-core_4.5.14+ds-1_alpha.deb
 4eada300eb08a6d7d4eaa052ebaa0c3efd415830 9488 nagios4_4.5.14+ds-1_alpha.buildinfo
 7bc4f2328ddf149008f1c6c6817d06e0e053062a 20636 nagios4_4.5.14+ds-1_alpha.deb
Checksums-Sha256:
 9d9aae4b27ac11b78f5855af17f245005811c521de3cd684f2bf5436516c7130 5762840 nagios4-cgi-dbgsym_4.5.14+ds-1_alpha.deb
 c2161f4b292aa6e92dd7323700d5629cd63f04aa1e2c057601ff66638d4b721f 1071420 nagios4-cgi_4.5.14+ds-1_alpha.deb
 0b719b205d3cb47acacd1f060ccd2c77d174c516fbd527106f819c19409fcd12 746880 nagios4-core-dbgsym_4.5.14+ds-1_alpha.deb
 18565bb38d3a0a938af1b0999061c265d66bd3d6b7a417293d5f7d43ab7ae8be 234828 nagios4-core_4.5.14+ds-1_alpha.deb
 3d2b553f998b3d44c1da41668ce835bc62957d5d782cf5db3afa73707e1d8619 9488 nagios4_4.5.14+ds-1_alpha.buildinfo
 4dff18ce138641cdd90f0123c05c672ded7d8f12508127923ba3cf969065b940 20636 nagios4_4.5.14+ds-1_alpha.deb
Files:
 d39586a001cf47d8222a78632e46ad35 5762840 debug optional nagios4-cgi-dbgsym_4.5.14+ds-1_alpha.deb
 b2c770562204638d04da6d5fb3463215 1071420 net optional nagios4-cgi_4.5.14+ds-1_alpha.deb
 7bee4cfb8694ba7a89da1b3d9d9a0a8e 746880 debug optional nagios4-core-dbgsym_4.5.14+ds-1_alpha.deb
 34c58bf50649beee850fa30982fcea4b 234828 net optional nagios4-core_4.5.14+ds-1_alpha.deb
 9314534d0405aadb8024846389ea8e72 9488 net optional nagios4_4.5.14+ds-1_alpha.buildinfo
 315af0ed91ffb98bcaa4da9a8237fe36 20636 net optional nagios4_4.5.14+ds-1_alpha.deb
Signed-By: Debian buildd autosigning key for alpha-sc-03 <buildd_alpha-alpha-sc-03@buildd.debian.org>