From foo@bar  Sat Oct 10 20:30:04 2026
Format: 1.8
Date: Mon, 31 Aug 2026 19:35:18 +1000
Source: nagios4
Binary: nagios4 nagios4-cgi nagios4-cgi-dbgsym nagios4-core nagios4-core-dbgsym
Architecture: powerpc
Version: 4.5.14+ds-1
Distribution: sid
Urgency: high
Maintainer: ppc64 / powerpc Build Daemon (blaauw) <blaauw2@blaauw.buildd.org>
Changed-By: Russell Stuart <russell-debian@stuart.id.au>
Description:
 nagios4    - host/service/network monitoring and management system
 nagios4-cgi - cgi files for nagios4
 nagios4-core - host/service/network monitoring and management system core files
Closes: 1063514 1119147 1121618 1123716 1144495 1145888
Changes:
 nagios4 (4.5.14+ds-1) unstable; urgency=high
 .
   * New upstream release (4.5.14).
   * Fixes reflected XSS in cmd.cgi via NagFormId (CVE-2026-48550),
     CSRF protection bypass via a self-supplied double-submit cookie
     (CVE-2026-48551), DOM XSS in jsonquery.js (CVE-2026-48552),
     authenticated RCE via custom-variable macro injection
     (CVE-2026-48553) and authenticated RCE via NOTIFICATION-family
     macro substitution (CVE-2026-48554).  Closes: #1144495.
   * Fixes the CSRF cookie bypass when no Cookie header is sent
     (CVE-2026-48549).  Closes: #1145888.
   * The daemon no longer contacts api.nagios.org by default, so it no
     longer segfaults parsing the reply.  Closes: #1119147.
   * Upstream 4.5.10 fixed the 64-bit time_t printf in lib/worker.c that
     made every check time land in 1970 on armhf.  Closes: #1123716.
   * Upstream 4.5.4 fixed the View Trends and View Alert Histogram links.
     Closes: #1063514.
   * Ship config.inc.php as a conffile in /etc/nagios4, symlinked into the
     htdocs directory, so paths can be overridden locally.  Closes: #1121618.
   * Make apache2 read /etc/nagios4/apache2.conf.
   * debian/watch: track upstream's GitHub tags, since SourceForge has
     carried no release since 4.5.9.
   * Rename 90_turn-off-use-authentication.path to .patch.
   * debian/rules: remove base/wpres-phash.h, include/Makefile and
     include/ignored_config.h in clean, so a second build in the same
     tree does not abort on unexpected upstream changes.
Checksums-Sha1:
 fea63b0a71304f759df4fe972897148f6594a555 6081704 nagios4-cgi-dbgsym_4.5.14+ds-1_powerpc.deb
 a813b22255c1b49931402336fc6e310c2ef53b26 964008 nagios4-cgi_4.5.14+ds-1_powerpc.deb
 743e1bd524860fac04acbc7c2e8986f3fb646fb3 780840 nagios4-core-dbgsym_4.5.14+ds-1_powerpc.deb
 2a7a473ba03b1279e1a72ce6b659258c1306c021 259848 nagios4-core_4.5.14+ds-1_powerpc.deb
 5becb029be89211b274186115bb6a6696d4afbcf 9571 nagios4_4.5.14+ds-1_powerpc.buildinfo
 9346174f286d9ab9717bf6e1b3695b8633ad74ff 20636 nagios4_4.5.14+ds-1_powerpc.deb
Checksums-Sha256:
 383ab073f838f41d6f5a903cfef20a27994348d589ec729dba89a0321bc58b43 6081704 nagios4-cgi-dbgsym_4.5.14+ds-1_powerpc.deb
 8aed736e5ff156c2188945b79b404c596f0ce5ee8a8474ed313fa260edef4222 964008 nagios4-cgi_4.5.14+ds-1_powerpc.deb
 d11acf1faeab1bf5ca1c05c1c407c3ff7d896ed341e39387185de8e50fb62d54 780840 nagios4-core-dbgsym_4.5.14+ds-1_powerpc.deb
 dffe17b6af7972d997eb9ee230366d4a8ef0544172d35eb5e430fd214b040c59 259848 nagios4-core_4.5.14+ds-1_powerpc.deb
 14ad32f1ae7af1b348b29517ea286ee7fbbfed4c0b502f0871c894db470d2805 9571 nagios4_4.5.14+ds-1_powerpc.buildinfo
 59f7c07192d92b6031a8da815d92f0b7a65717babe0143ab5b0288adf53ccba7 20636 nagios4_4.5.14+ds-1_powerpc.deb
Files:
 68aff11aa0bfdd79d88fc1529be137d2 6081704 debug optional nagios4-cgi-dbgsym_4.5.14+ds-1_powerpc.deb
 0f13456952bbf80afa506010c7fa9760 964008 net optional nagios4-cgi_4.5.14+ds-1_powerpc.deb
 55dcc70e1781ce064dcf6e08866fd115 780840 debug optional nagios4-core-dbgsym_4.5.14+ds-1_powerpc.deb
 5f6e3b08a8885078b83bb29b8a078343 259848 net optional nagios4-core_4.5.14+ds-1_powerpc.deb
 61d05a576f3f8a69b2b9b91bc1efd985 9571 net optional nagios4_4.5.14+ds-1_powerpc.buildinfo
 b6c4f6809b50d72248ff3f354a084330 20636 net optional nagios4_4.5.14+ds-1_powerpc.deb
Signed-By: Debian buildd autosigning key for blaauw <buildd_ppc64-blaauw@buildd.debian.org>