From foo@bar  Fri Oct  9 19:50:02 2026
Format: 1.8
Date: Mon, 31 Aug 2026 19:35:18 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: m68k
Version: 4.5.14+ds-1
Distribution: sid
Urgency: high
Maintainer: m68k Build Daemon (m68k-gandi-02) <buildd@m68k-gandi-02.buildd.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Closes: 1063514 1119147 1121618 1123716 1144495 1145888
Changes:
 nagios4 (4.5.14+ds-1) unstable; urgency=high
 .
   * New upstream release (4.5.14).
   * Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550),
     CSRF protection bypass via a self-supplied double-submit cookie
     (CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552),
     authenticated RCE via custom-variable macro injection
     (CVE-2026-48553) and authenticated RCE via NOTIFICATION-family
     macro substitution (CVE-2026-48554).  Closes: #1144495.
   * Fixes the CSRF cookie bypass when no Cookie header is sent
     (CVE-2026-48549).  Closes: #1145888.
   * The daemon no longer contacts api.nagios.org by default, so it no
     longer segfaults parsing the reply.  Closes: #1119147.
   * Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that
     made every check time land in 1970 on armhf.  Closes: #1123716.
   * Upstream 4.5.4 fixed the View Trends and View Alert Histogram links.
     Closes: #1063514.
   * Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the
     htdocs directory, so paths can be overridden locally.  Closes: #1121618.
   * Make apache2 read /etc/nagios4/apache2.conf.
   * debian/watch: track upstream's GitHub tags, since SourceForge has
     carried no release since 4.5.9.
   * Rename 90_turn-off-use-authentication.path to .patch.
   * debian/rules: remove base/wpres-phash.h, include/Makefile and
     include/ignored_config.h in clean, so a second build in the same
     tree does not abort on unexpected upstream changes.
Checksums-Sha1:
 6e89477b59930f1b7c76914b39761de3f232d616 5298604 nagios4-cgi-dbgsym_4.5.14+ds-1_m68k.deb
 ba6c9fc16eda918f5b551cc6543ee5a9321434ff 855452 nagios4-cgi_4.5.14+ds-1_m68k.deb
 68d28b75dee3ac6628d2e8add226380e7938d4b4 718140 nagios4-core-dbgsym_4.5.14+ds-1_m68k.deb
 c498b72d2f80dddb12789fa39b4aae86222bb0b4 185656 nagios4-core_4.5.14+ds-1_m68k.deb
 de7521af7299ef0060597503fdf910cbf0a4214c 9439 nagios4_4.5.14+ds-1_m68k.buildinfo
 af9910c59cbf505d3104b8cdec818a7e0e05bbad 20636 nagios4_4.5.14+ds-1_m68k.deb
Checksums-Sha256:
 869abc6438c98f8fbee9175ef7a233da5597575a6c2cc987d0ba2412af057631 5298604 nagios4-cgi-dbgsym_4.5.14+ds-1_m68k.deb
 f56a92c0c917be4f984a782fc2bcbb334d23581575081b733f981d9d37fdacab 855452 nagios4-cgi_4.5.14+ds-1_m68k.deb
 324a559cd2a648954aaefb89453a8c89d02963eb0f47fada2876ccda92f0bcca 718140 nagios4-core-dbgsym_4.5.14+ds-1_m68k.deb
 ba8e2fe15b9492191b16a8b3384100658726b654526270401a6c52f5852053ee 185656 nagios4-core_4.5.14+ds-1_m68k.deb
 e4e4cd7f6abf7ac225dd46223c6bfbcecde8dd6c6d03025cba6af74ddbfa1233 9439 nagios4_4.5.14+ds-1_m68k.buildinfo
 60bac70f54d8cb73cab5fa4def065da7a875a4b9fd8096b90e2d60bc42f2be39 20636 nagios4_4.5.14+ds-1_m68k.deb
Files:
 f67e85d96bb0f5c43fb3431f6c72f4f7 5298604 debug optional nagios4-cgi-dbgsym_4.5.14+ds-1_m68k.deb
 4bcad153b444e9273bed6859b0376a0f 855452 net optional nagios4-cgi_4.5.14+ds-1_m68k.deb
 5de6321e55dcdaa52b1ebc9a5ef20890 718140 debug optional nagios4-core-dbgsym_4.5.14+ds-1_m68k.deb
 cccd7440b6363d3ed7a5868c8433c048 185656 net optional nagios4-core_4.5.14+ds-1_m68k.deb
 388c3c74159f00f34fc2eaa2f0915d2b 9439 net optional nagios4_4.5.14+ds-1_m68k.buildinfo
 e7d52008e050e588f957ae9532382751 20636 net optional nagios4_4.5.14+ds-1_m68k.deb
Signed-By: Debian buildd autosigning key for m68k-gandi-02 <buildd_m68k-m68k-gandi-02@buildd.debian.org>