Debian Patches
Status for nagios4/4.4.6-4+deb12u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 50-log-file-location.patch | Move log files to where Debian has them: /var/log. | Russell Stuart <russell-debian@stuart.id.au> | no | |||
| 55_strip_logarchivepath.patch | stripping the log_archive_path value from cgi.cfg (#578232) | Omni Flux <omniflux@omniflux.com> | no | |||
| 60_debianise_plugins.patch | Debianise the config | Russell Stuart <russell-debian@stuart.id.au> | no | |||
| 70_remove_check-host-alive.patch | Remove check-host-alive as it conflicts with the command of the same name from ping.cfg in monitoring-plugins-basic. |
Russell Stuart <russell-debian@stuart.id.au> | no | |||
| 80_no_phone_home.patch | Remove stuff that pings Nagios or youtube. | Russell Stuart <russell-debian@stuart.id.au> | no | |||
| 90_turn-off-use-authentication.path | Turn off nagios security This is done so a newbie can play with the default install. As a compromise the shipped apache2.conf only allows private ip's access. |
Russell Stuart <russell-debian@stuart.id.au> | no | |||
| 9103-fix-unknown-rpm-arch.patch | Skip the RPM_ARCH check when building for Debian. Fixes #902216 =================================================================== |
Russell Stuart <russell-debian@stuart.id.au> | no | |||
| 95_CSRF-cookie-security-fix.patch | CSRF security fix backported from upstream 4.5.12. . cgi/cmd.c: make the CSRF cookie mandatory (default formid_ok=ERROR, not OK), generate a pseudo-random NagFormId cookie server-side in cmd.cgi's document_header() and emit it via Set-Cookie with SameSite=Strict. Previously the cookie was generated client-side by JavaScript in html/index.php, which is bypassed by attacker pages. html/index.php.in: remove the now-redundant client-side cookie setter. . See upstream's disclosure at https://www.nagios.com/security-disclosures/nagios-core/4-5-12/ . |
Emmett Kapsner <ekapsner@nagios.com> | no | upstream, https://github.com/NagiosEnterprises/nagioscore/commit/e5ed38e53a5d65721520c7c67be0746d63da28cb | ||
| 96_CSRF-cookie-fail-open-option.patch | Add `cgi_cookie_fail_open` config option for the CSRF cookie check. . The security fix in 95_CSRF-cookie-security-fix.patch unconditionally rejects any request to cmd.cgi that arrives without a valid NagFormId cookie. That is the secure default, but it also breaks legitimate third-party integrations (custom dashboards, automation scripts, add-ons like NagiosBP) that POST commands to cmd.cgi without first visiting the web UI in the same browser session. . This patch (upstream PR 1055, merged 2026-04-03, scheduled for the next upstream release after 4.5.12) adds a cgi.cfg option: . cgi_cookie_fail_open=0 (default: secure -- reject without cookie) cgi_cookie_fail_open=1 (insecure: revert to pre-fix behaviour) . Setting it to 1 reopens the CSRF window, but is the only way to keep those third-party integrations working without rewriting them to authenticate via the UI first. . NOTE for Debian: this option is *not* in upstream 4.5.12, only in the unreleased 4.5.13+. It is present in this 4.4.6-4.1+deb12u1 stable security update so that bookworm users can opt back to the old behaviour locally; it will disappear when the package is upgraded to 4.5.12+ds via bookworm -> trixie. |
Emmett Kapsner <ekapsner@nagios.com> | no | upstream, https://github.com/NagiosEnterprises/nagioscore/pull/1055 |
All known versions for source package 'nagios4'
- 4.5.12+ds-1 (forky, sid)
- 4.4.6-4.1+deb13u1 (trixie-security, trixie)
- 4.4.6-4+deb12u1 (bookworm, bookworm-security)