Change log for nagios2 package in Ubuntu

nagios2 (2.11-1ubuntu1.5) hardy-security; urgency=low

  * SECURITY UPDATE: remote code execution via shell metacharacters.
    - debian/patches/33_CVE_2009_2288.dpatch: make sure host ip and
      arguments are valid in cgi/statuswml.c.
    - CVE-2009-2288

 -- Marc Deslauriers <email address hidden>   Thu, 02 Jul 2009 09:08:43 -0400

Available diffs

• diff from 2.11-1ubuntu1.4 to 2.11-1ubuntu1.5 (1.3 KiB)

nagios2 (2.11-1ubuntu1.4) hardy-security; urgency=low

  * SECURITY UPDATE: authorization check bypass and arbitrary command
    execution via custom form or browser addon (LP: #301542)
    - debian/patches/31_CVE_2008_5027.dpatch: cgi/cmd.c: strip semicolons and
      newlines in commit_command().
    - CVE-2008-5027
  * SECURITY UPDATE: Cross-site request forgery (CSRF) arbitrary command
    execution (LP: #301542)
    - debian/patches/32_CVE_2008_5028.dpatch: disable CMD_CHANGE commands in
      base/commands.c
    - CVE-2008-5028
  * debian/rules: do not update po tree for security updates.

 -- Marc Deslauriers <email address hidden>   Mon, 22 Dec 2008 10:52:07 -0500

Available diffs

• diff from 2.11-1ubuntu1 (in Ubuntu) to 2.11-1ubuntu1.4 (7.1 KiB)

nagios2 (2.11-1ubuntu1.3) hardy-proposed; urgency=low

  * Modified cfg-commands.cfg.diff to replace /bin/mail references
    in resulting commands.cfg and use /usr/bin/mail instead (LP: #231004),
    work based on a patch provided by Erik Forsberg.
  * Fix reloading so that it doesn't just stop the daemon (LP: #252686)

 -- Thierry Carrez <email address hidden>   Tue, 02 Sep 2008 14:59:26 +0200

Available diffs

• diff from 2.11-1ubuntu1 to 2.11-1ubuntu1.3 (5.9 KiB)

nagios2 (2.11-1ubuntu1.2) hardy-security; urgency=low

  * SECURITY UPDATE: fix XSS issues in CGI scripts thanks to Thierry Carrez
  * debian/rules: fix nagios2-common upgrade failure. Thanks to Thierry Carrez
  * References
    CVE-2007-5803
    LP: #238516
    LP: #220208

 -- Jamie Strandboge <email address hidden>   Thu, 19 Jun 2008 12:30:11 -0400

Available diffs

• diff from 2.11-1.1ubuntu1 to 2.11-1ubuntu1.2 (9.6 KiB)

nagios2 (2.11-1.1ubuntu1) intrepid; urgency=low

  * Merge from debian unstable, remaining changes:
    * debian/nagios2-common.nagios2.init
      - Fix init script pid file. (LP: #174466)
    * Update maintainers as per spec.
  * debian/nagios2-common.nagios2.init
    - Fix reload so it doesnt kill nagios. Thanks to Matt Brown and
      Nicolas Vialcaircel. (LP: #236373)

Available diffs

• diff from 2.11-1ubuntu1 to 2.11-1.1ubuntu1 (5.1 KiB)

nagios2 (2.11-1ubuntu1) hardy; urgency=low

  * debian/nagios2-common.nagios2.init
    - Fix init script pid file. (LP: #174466)
  * Update maintainers as per spec.

 -- Chuck Short <email address hidden>   Mon, 07 Apr 2008 14:36:49 -0400

nagios2 (2.11-1) unstable; urgency=low

  * new upstream version
  * remove wrong NOT RELEASED YET entry from 2.10-1 changelog
  * Add debian/watch file. Thanks to Raphael Geissert. Closes: #456018
  * init script: Tell killproc which daemon to kill.
    Thanks to Mark Petersen. Closes: #456958
  * Steal copyright file from Nagios3
  * Standards-Version: 3.7.3 (no changes necessary)
  * Add a description to 10_p1_pl_shebang.dpatch
  * Override empty directory warning for usr/share/nagios2/htdocs/ssi/
  * fix Errors in manpages by removing .Xc

  [Jan Wagner]
  * added Vcs- fields

 -- William Grant <email address hidden>   Fri,  28 Mar 2008 09:46:42 +0000

nagios2 (2.10-1) unstable; urgency=low

  * NOT RELEASED YET
  * New upstream release
    * Fix XSS vulnerability (CVS-2007-5624). Closes: #448371
  * Adapt sample config patches
  * Fix permissions on /var/log/nagios2/archives.
    Thanks to Michael Feger. Closes: #429820
  * Fix typo in localhost_nagios2.cfg.
    Thanks to Justin Pryzby. Closes: #430477.
  * New Portuguese debconf translations from Rui Branco and the Traduz
    team. Closes: #436155.
  * Rearrange apache2.conf so that the Stylesheet alias path is
    actually used.
    Thanks to Joerg Dorchain. This may fix #420009
  * Relax dependency on web server to Recommends. Depend on
    apache2-utils since we need htpasswd.
    Thanks to Japp Eldering. Closes: #413519
  * Move stylesheets to /etc, create a symlink.
    Thanks to Joerg Dorchain and Steve Greenland. Closes: #420011
  * Fix suboptimal formatting of package descriptions.
    Thanks to Sam Morris. Closes: 413494
  * debian/control: re-order Source stanza according to dpkg 1.14.7,
    add Homepage field. We're going to leave in the Upstream URL in the
    package description for a while though.
  * Unmark package names for translation in debconf templates.
    Thanks to Kobayashi Noritada. Closes: #413127

  [Jan Wagner]
  * fixed README.Debian about setting check_external_commands=1
    (closes: #431953).

 -- Ubuntu Archive Auto-Sync <email address hidden>   Mon,  05 Nov 2007 19:30:30 +0000

nagios2 (2.9-1) unstable; urgency=low

  * New upstream release (closes: #414647).
  * new dutch (nl) debconf translations from cobaco (closes: #414762).
  * new japanese (ja) debconf translations from Kobayashi Noritada
    (closes: #413122).
  * Fix wrong path to debian.gd2 in extinfo_nagios2.cfg (closes: #423639).
  [Sean Finney]
  * various fixes/cleanups in init script should resolve issues with
    pidfile handling etc (closes: #416763, #397289, #414050, #412980, #415752).
  * Merge config file changes.
  * add note for pam_tmpdir users about setting TMPDIR in
    /etc/nagios2/default.  thanks to Richard A Nelson (closes: #414652)

 -- Ubuntu Archive Auto-Sync <email address hidden>   Mon,  11 Jun 2007 18:45:53 +0100

nagios2 (2.6-3) unstable; urgency=low

  [Marc Haber]
  * services_nagios2.cfg: add default notification_interval 0 clauses to
    make it clear that nagios won't re-notify by default.
    Thanks to Jan Wagner.
  * Add symlink from /usr/share/nagios2/htdocs/docs to
    /usr/share/doc/nagios2-doc/html as suggested by Mike O'Connor.
    Closes: #408141
  * init script: use awk -v FS. Thanks to Mike O'Connor. Closes: #408136
  * init script: remove commented sleep-rekill loop which was confusing
    to some users. It has never been enabled in nagios2 and is probably
    left over from whatever package the original nagios2 init script
    was taken from. Closes: #408231
  * run debconf-updatepo and commit new files

  [Sean Finney]
  * added Build-Depends on dpkg-dev >= 1.13.19, since our use of
    source:Version in debian/control requires it.

 -- Ubuntu Archive Auto-Sync <email address hidden>   Fri,  27 Apr 2007 00:46:29 +0100

nagios2 (2.6-2) unstable; urgency=low

  * new german debconf translations from Matthias Julius (closes: #400700).
  * remove check_dns from commands.cfg.
    Thanks to Dr. Tilo Levante. Closes: #402303
  * nagios2-common.postinst: Take 127.0.0.1 as default default gateway.
  * nagios2-common.postrm: Send dpkg-statoverride standard error to
    the bin to avoid a row of "No override present" error messages on
    purge.
  * Ship our own resource.cfg with nagios2-common

 -- Ubuntu Archive Auto-Sync <email address hidden>   Wed,  20 Dec 2006 13:00:52 +0000

nagios2 (2.6-1) unstable; urgency=low

  * new upstream version
  * adapt configuration patches
  * adapt installation lists
  * Add README reference to nagios.cfg regarding the command file
  * Add no-op logrotate file to really disable logrorate log rotation.
    Closes: #396173, #401546

 -- Ubuntu Archive Auto-Sync <email address hidden>   Thu,  07 Dec 2006 09:43:36 +0000

nagios2 (2.5-3) unstable; urgency=low

  [sean finney]
  * add explicit DirectoryIndex to apache configuration, thanks to
    Heiko Schlittermann for suggesting this (closes: #396100).
  * the previous dpatch for the fixed path in submit_check_result wasn't
    actually set to apply (closes: #396661).  thanks to Richard Nelson
    for pointing this out again.

nagios2 (2.4-1) unstable; urgency=low

  * new upstream version. (mh) Closes: #369801
  * now use install-unstripped target instead of 10no-strip patch.
  * remove 20-handle-master-proc-event patch, fixed upstream.