Version in base suite: 4.4.6-4.1+deb13u1 Base version: nagios4_4.4.6-4.1+deb13u1 Target version: nagios4_4.4.6-4.1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/nagios4/nagios4_4.4.6-4.1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/nagios4/nagios4_4.4.6-4.1+deb13u2.dsc changelog | 22 ++++++++ patches/100_CVE-2026-48552.patch | 27 ++++++++++ patches/101_CVE-2026-48553.patch | 31 +++++++++++ patches/102_CVE-2026-48554.patch | 31 +++++++++++ patches/103_getcgi-pairlist-truncation.patch | 33 ++++++++++++ patches/97_CVE-2026-48549.patch | 33 ++++++++++++ patches/98_CVE-2026-48550.patch | 26 ++++++++++ patches/99_CVE-2026-48551.patch | 70 +++++++++++++++++++++++++++ patches/series | 7 ++ 9 files changed, 280 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpwywf3oz8/nagios4_4.4.6-4.1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpwywf3oz8/nagios4_4.4.6-4.1+deb13u2.dsc: no acceptable signature found diff -Nru nagios4-4.4.6/debian/changelog nagios4-4.4.6/debian/changelog --- nagios4-4.4.6/debian/changelog 2026-05-22 10:45:00.000000000 +0000 +++ nagios4-4.4.6/debian/changelog 2026-08-31 09:56:29.000000000 +0000 @@ -1,3 +1,25 @@ +nagios4 (4.4.6-4.1+deb13u2) trixie-security; urgency=high + + * The CSRF fix previously backported in 4.4.6-4.1+deb13u1 is now + tracked as CVE-2026-48548. + * Backport upstream 4.5.13 and 4.5.14 security fixes: + - CSRF protection bypass in cmd.cgi, where a request sending no + Cookie header could supply both halves of the double-submit + cookie itself (CVE-2026-48549). + - Reflected XSS in cmd.cgi via the NagFormId parameter + (CVE-2026-48550). + - CSRF protection bypass via a self-supplied double-submit cookie + (CVE-2026-48551). + - DOM-based XSS in jsonquery.js (CVE-2026-48552). + - Authenticated remote code execution via custom-variable macro + injection (CVE-2026-48553). + - Authenticated remote code execution via unfiltered + NOTIFICATION-family macro substitution (CVE-2026-48554). + * Fix a one-element heap overflow in getcgivars() when a request with + no parameters carries a NagFormId cookie. No CVE assigned. + + -- Russell Stuart Mon, 31 Aug 2026 19:56:29 +1000 + nagios4 (4.4.6-4.1+deb13u1) trixie-security; urgency=high * CSRF Security Fix backported from upstream 4.5.12 commit diff -Nru nagios4-4.4.6/debian/patches/100_CVE-2026-48552.patch nagios4-4.4.6/debian/patches/100_CVE-2026-48552.patch --- nagios4-4.4.6/debian/patches/100_CVE-2026-48552.patch 1970-01-01 00:00:00.000000000 +0000 +++ nagios4-4.4.6/debian/patches/100_CVE-2026-48552.patch 2026-08-31 09:56:29.000000000 +0000 @@ -0,0 +1,27 @@ +Author: Emmett Kapsner +Origin: upstream, https://github.com/NagiosEnterprises/nagioscore/commit/acd2365e816dda4a8dce61709f8d3a3b4ab04a6f +Description: CVE-2026-48552: DOM-based XSS in jsonquery.js. + The JSON query results page rendered unencoded string values from + stored fields straight into the DOM via jQuery's .html(), so values + an attacker had previously stored (host names, comments, plugin + output) executed as script when a user viewed the page. + . + Render the response as text inside a 
 element instead.
+ .
+ Released in Nagios Core 4.5.14.  Reported by Zach Hanley of Horizon3.ai.
+ See upstream's
+ disclosure at https://www.nagios.com/security-disclosures/nagios-
+ core/4-5-14/ .
+Bug-Debian: https://bugs.debian.org/1144495
+
+--- a/html/js/jsonquery.js
++++ b/html/js/jsonquery.js
+@@ -554,7 +554,7 @@
+ 				parameters, 
+ 				function(data, results) {
+ 					$('#results').append( 
+-						$('
').html( objectToString( 0, data))
++						$('
').text( JSON.stringify(data, null, 2))
+ 					);
+ 				}
+ 			);
diff -Nru nagios4-4.4.6/debian/patches/101_CVE-2026-48553.patch nagios4-4.4.6/debian/patches/101_CVE-2026-48553.patch
--- nagios4-4.4.6/debian/patches/101_CVE-2026-48553.patch	1970-01-01 00:00:00.000000000 +0000
+++ nagios4-4.4.6/debian/patches/101_CVE-2026-48553.patch	2026-08-31 09:56:29.000000000 +0000
@@ -0,0 +1,31 @@
+Author: Emmett Kapsner 
+Origin: upstream, https://github.com/NagiosEnterprises/nagioscore/commit/0b68220529d461c9fba198a904049ea332bdb1da
+Description: CVE-2026-48553: authenticated RCE via custom-variable macro injection.
+ Custom variable macros ($_HOST.../$_SERVICE.../$_CONTACT...) were
+ expanded into command lines without the illegal-character filtering
+ applied to other untrusted macros, so shell metacharacters stored in a
+ custom variable -- reachable through the Nagios Remote Data Processor
+ in a non-default configuration -- ran as the nagios user.
+ .
+ Always set STRIP_ILLEGAL_MACRO_CHARS when expanding a custom macro.
+ .
+ Released in Nagios Core 4.5.13.  Reported by Gabriel "Texugo" Rodrigues.
+ See upstream's
+ disclosure at https://www.nagios.com/security-disclosures/nagios-
+ core/4-5-13/ .
+Bug-Debian: https://bugs.debian.org/1144495
+
+--- a/common/macros.c
++++ b/common/macros.c
+@@ -636,6 +636,11 @@
+ 
+ 		/* get the macro value */
+ 		result = grab_custom_macro_value_r(mac, macro_name, arg[0], arg[1], output);
++
++		/* always strip illegal characters from custom macros */
++		if (clean_options){
++			*clean_options |= STRIP_ILLEGAL_MACRO_CHARS;
++			}
+ 		}
+ 
+ 	/* no macro matched... */
diff -Nru nagios4-4.4.6/debian/patches/102_CVE-2026-48554.patch nagios4-4.4.6/debian/patches/102_CVE-2026-48554.patch
--- nagios4-4.4.6/debian/patches/102_CVE-2026-48554.patch	1970-01-01 00:00:00.000000000 +0000
+++ nagios4-4.4.6/debian/patches/102_CVE-2026-48554.patch	2026-08-31 09:56:29.000000000 +0000
@@ -0,0 +1,31 @@
+Author: Emmett Kapsner 
+Origin: upstream, https://github.com/NagiosEnterprises/nagioscore/commit/1d1f65390dae0bdff05da4ccba4b2db58c0f0d8e
+Description: CVE-2026-48554: authenticated RCE via NOTIFICATION macro substitution.
+ The $NOTIFICATIONAUTHOR$, $NOTIFICATIONAUTHORNAME$,
+ $NOTIFICATIONAUTHORALIAS$ and $NOTIFICATIONCOMMENT$ macros were
+ substituted unfiltered, so an author or comment submitted through
+ cmd.cgi's com_data parameter could inject shell metacharacters into a
+ notification command.
+ .
+ Give them the same STRIP_ILLEGAL_MACRO_CHARS and ESCAPE_MACRO_CHARS
+ treatment as the other operator-supplied macros.
+ .
+ Released in Nagios Core 4.5.14.  Reported by Zach Hanley of Horizon3.ai.
+ See upstream's
+ disclosure at https://www.nagios.com/security-disclosures/nagios-
+ core/4-5-14/ .
+Bug-Debian: https://bugs.debian.org/1144495
+
+--- a/common/macros.c
++++ b/common/macros.c
+@@ -2662,6 +2662,10 @@
+ 		case MACRO_SERVICEPERFDATA:
+ 		case MACRO_SERVICEACKAUTHOR:
+ 		case MACRO_SERVICEACKCOMMENT:
++		case MACRO_NOTIFICATIONAUTHOR:
++		case MACRO_NOTIFICATIONAUTHORNAME:
++		case MACRO_NOTIFICATIONAUTHORALIAS:
++		case MACRO_NOTIFICATIONCOMMENT:
+ 			macro_keys[x].options |= STRIP_ILLEGAL_MACRO_CHARS | ESCAPE_MACRO_CHARS;
+ 			break;
+ 		}
diff -Nru nagios4-4.4.6/debian/patches/103_getcgi-pairlist-truncation.patch nagios4-4.4.6/debian/patches/103_getcgi-pairlist-truncation.patch
--- nagios4-4.4.6/debian/patches/103_getcgi-pairlist-truncation.patch	1970-01-01 00:00:00.000000000 +0000
+++ nagios4-4.4.6/debian/patches/103_getcgi-pairlist-truncation.patch	2026-08-31 09:56:29.000000000 +0000
@@ -0,0 +1,33 @@
+Author: Ariadne Conill 
+Origin: upstream, https://github.com/NagiosEnterprises/nagioscore/commit/32eaed0f3e99b05f4339ed85fb6a2dea6a53b41e
+Description: Fix one-element heap overflow when appending the NagFormId cookie.
+ No CVE has been assigned to this as yet.  It is a memory-safety bug in
+ the same function as the CVE fixes above, reachable from an
+ unauthenticated request, so it is fixed here too.
+ .
+ getcgivars() allocates pairlist in blocks of 256 entries, then appends
+ the NagFormId cookie under an "if(!(paircount % 256))" guard that also
+ fires when paircount is still zero.  For a request with no query
+ parameters and no request body the realloc() therefore *shrinks* the
+ array to a single element, after which the cookie is stored in
+ pairlist[0] and the NULL terminator is written to pairlist[1], one
+ element past the end of the allocation.
+ .
+ Reserve two elements, as upstream does.
+ .
+ Committed upstream 2021-03-13, first released in Nagios Core 4.4.7.
+ Upstream did not treat it as a security fix and issued no disclosure.
+
+--- a/cgi/getcgi.c
++++ b/cgi/getcgi.c
+@@ -252,7 +252,9 @@
+ 		formid = strstr(cookies, "NagFormId=");
+ 		if (formid) {
+ 			if(!(paircount % 256)) {
+-				pairlist = (char **)realloc(pairlist, (paircount + 1) * sizeof(char *));
++				/* if no query parameters were provided, paircount can begin as zero, resulting in */
++				/* truncation of the pairlist array if we do not reserve at least two elements. */
++				pairlist = (char **)realloc(pairlist, (paircount + 2) * sizeof(char *));
+ 				if(pairlist == NULL) {
+ 					printf("getcgivars(): Could not re-allocate memory for name-value pairlist.\n");
+ 					exit(1);
diff -Nru nagios4-4.4.6/debian/patches/97_CVE-2026-48549.patch nagios4-4.4.6/debian/patches/97_CVE-2026-48549.patch
--- nagios4-4.4.6/debian/patches/97_CVE-2026-48549.patch	1970-01-01 00:00:00.000000000 +0000
+++ nagios4-4.4.6/debian/patches/97_CVE-2026-48549.patch	2026-08-31 09:56:29.000000000 +0000
@@ -0,0 +1,33 @@
+Author: Emmett Kapsner 
+Origin: upstream, https://github.com/NagiosEnterprises/nagioscore/commit/02aba584656eb10c2ff83a696b166f4bc7dd1304
+Description: CVE-2026-48549: CSRF protection bypass in cmd.cgi.
+ cmd.cgi's double-submit cookie check compares the NagFormId cookie
+ against the nagFormId form field.  getcgivars() appended the cookie to
+ the same name/value list it built from the query string and the POST
+ body, so a request that carried no Cookie header at all could supply
+ both halves itself and satisfy the comparison, letting an attacker
+ submit Nagios commands as an authenticated user.
+ .
+ Ignore any NagFormId supplied through the query string or request body,
+ so it can only ever come from a real cookie.
+ .
+ Released in Nagios Core 4.5.13.  Reported by SeungMyung Lee.  See
+ upstream's
+ disclosure at https://www.nagios.com/security-disclosures/nagios-
+ core/4-5-13/ .
+Bug-Debian: https://bugs.debian.org/1145888
+
+--- a/cgi/getcgi.c
++++ b/cgi/getcgi.c
+@@ -222,6 +222,11 @@
+ 	paircount = 0;
+ 	nvpair = strtok(cgiinput, "&");
+ 	while(nvpair) {
++		/* NagFormId must come from a cookie - skip any attempt to set it by other means */
++		if (strstr(nvpair, "NagFormId=")){
++			nvpair = strtok(NULL, "&");
++			continue;
++			}
+ 		pairlist[paircount] = strdup(nvpair);
+ 		if( NULL == pairlist[paircount]) {
+ 			printf("getcgivars(): Could not allocate memory for name-value pair #%d.\n", paircount);
diff -Nru nagios4-4.4.6/debian/patches/98_CVE-2026-48550.patch nagios4-4.4.6/debian/patches/98_CVE-2026-48550.patch
--- nagios4-4.4.6/debian/patches/98_CVE-2026-48550.patch	1970-01-01 00:00:00.000000000 +0000
+++ nagios4-4.4.6/debian/patches/98_CVE-2026-48550.patch	2026-08-31 09:56:29.000000000 +0000
@@ -0,0 +1,26 @@
+Author: Emmett Kapsner 
+Origin: upstream, https://github.com/NagiosEnterprises/nagioscore/commit/acd2365e816dda4a8dce61709f8d3a3b4ab04a6f
+Description: CVE-2026-48550: reflected XSS in cmd.cgi via NagFormId.
+ The NagFormId value is echoed back into the generated HTML without
+ being sanitised, so an attacker who can get a victim to load a crafted
+ URL can execute JavaScript in the victim's session.
+ .
+ Strip angle brackets from the cookie value, as is already done for the
+ other CGI inputs.
+ .
+ Released in Nagios Core 4.5.14.  Reported by Zach Hanley of Horizon3.ai.
+ See upstream's
+ disclosure at https://www.nagios.com/security-disclosures/nagios-
+ core/4-5-14/ .
+Bug-Debian: https://bugs.debian.org/1144495
+
+--- a/cgi/cmd.c
++++ b/cgi/cmd.c
+@@ -716,6 +716,7 @@
+ 			}
+ 
+ 			cookie_form_id = (char*)strdup(variables[x]);
++			strip_html_brackets(cookie_form_id);
+ 		}
+ 
+ 		/* we found the form id on the form */
diff -Nru nagios4-4.4.6/debian/patches/99_CVE-2026-48551.patch nagios4-4.4.6/debian/patches/99_CVE-2026-48551.patch
--- nagios4-4.4.6/debian/patches/99_CVE-2026-48551.patch	1970-01-01 00:00:00.000000000 +0000
+++ nagios4-4.4.6/debian/patches/99_CVE-2026-48551.patch	2026-08-31 09:56:29.000000000 +0000
@@ -0,0 +1,70 @@
+Author: Emmett Kapsner 
+Origin: upstream, https://github.com/NagiosEnterprises/nagioscore/commit/bcd4c2a4b5dfe51bdb2b227af8945ad8751a820d
+ and https://github.com/NagiosEnterprises/nagioscore/commit/acd2365e816dda4
+ a8dce61709f8d3a3b4ab04a6f
+Description: CVE-2026-48551: CSRF bypass via a self-supplied double-submit cookie.
+ Completes the fix in 97_CVE-2026-48549.patch.  Matching "NagFormId="
+ anywhere in a name/value pair rather than only at its start let the
+ check be evaded, and the CGI input was unescaped only after the pair had
+ been split, so a percent-encoded parameter name could smuggle one past
+ the test.  Unescape each pair before inspecting it and anchor the
+ comparison at the start of the name.
+ .
+ Also mark the NagFormId cookie HttpOnly so script running in the page
+ cannot read it.
+ .
+ Released in Nagios Core 4.5.14.  Reported by Zach Hanley of Horizon3.ai.
+ See upstream's
+ disclosure at https://www.nagios.com/security-disclosures/nagios-
+ core/4-5-14/ .
+Bug-Debian: https://bugs.debian.org/1144495
+
+--- a/cgi/cmd.c
++++ b/cgi/cmd.c
+@@ -295,7 +295,7 @@
+ 			exit(1);
+ 		}
+ 
+-		printf("Set-Cookie: NagFormId=%s; SameSite=Strict\r\n", cookie_form_id);
++		printf("Set-Cookie: NagFormId=%s; SameSite=Strict; HttpOnly\r\n", cookie_form_id);
+ 	}
+ }
+ 
+--- a/cgi/getcgi.c
++++ b/cgi/getcgi.c
+@@ -222,8 +222,10 @@
+ 	paircount = 0;
+ 	nvpair = strtok(cgiinput, "&");
+ 	while(nvpair) {
++		unescape_cgi_input(nvpair);
++
+ 		/* NagFormId must come from a cookie - skip any attempt to set it by other means */
+-		if (strstr(nvpair, "NagFormId=")){
++		if (strncmp(nvpair, "NagFormId=", 10) == 0){			/* 10 is the length of NagFormId= */
+ 			nvpair = strtok(NULL, "&");
+ 			continue;
+ 			}
+@@ -294,7 +296,6 @@
+ 				printf("getcgivars(): Could not allocate memory for cgi value #%d.\n", i);
+ 				exit(1);
+ 				}
+-			unescape_cgi_input(cgivars[i * 2 + 1]);
+ 			}
+ 		else {
+ 			cgivars[i * 2 + 1] = strdup("");
+@@ -302,7 +303,6 @@
+ 				printf("getcgivars(): Could not allocate memory for empty stringfor variable value #%d.\n", i);
+ 				exit(1);
+ 				}
+-			unescape_cgi_input(cgivars[i * 2 + 1]);
+ 			}
+ 
+ 		/* get the variable value (or name/value of there was no real "pair" in the first place) */
+@@ -311,7 +311,6 @@
+ 			printf("getcgivars(): Could not allocate memory for cgi name #%d.\n", i);
+ 			exit(1);
+ 			}
+-		unescape_cgi_input(cgivars[i * 2]);
+ 		}
+ 
+ 	/* terminate the name-value list */
diff -Nru nagios4-4.4.6/debian/patches/series nagios4-4.4.6/debian/patches/series
--- nagios4-4.4.6/debian/patches/series	2026-05-22 10:28:20.000000000 +0000
+++ nagios4-4.4.6/debian/patches/series	2026-08-31 09:56:29.000000000 +0000
@@ -7,3 +7,10 @@
 9103-fix-unknown-rpm-arch.patch
 95_CSRF-cookie-security-fix.patch
 96_CSRF-cookie-fail-open-option.patch
+97_CVE-2026-48549.patch
+98_CVE-2026-48550.patch
+99_CVE-2026-48551.patch
+100_CVE-2026-48552.patch
+101_CVE-2026-48553.patch
+102_CVE-2026-48554.patch
+103_getcgi-pairlist-truncation.patch