[rpms/nagios-plugins] epel9: Update to upstream (bz#2453492)

[rpms/nagios-plugins] epel9: Update to upstream (bz#2453492)

[Jan ONDREJ]

            A new commit has been pushed.

            Repo   : rpms/nagios-plugins
            Branch : epel9
            Commit : fa2db0ad4a694951953db19a5295859049a7e0ad
            Author : Jan ONDREJ (SAL) <ondrejj(at)salstar.sk>
            Date   : 2026-08-24T12:50:03+02:00
            Stats  : +57/-8 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/nagios-plugins/c/fa2db0ad4a694951953db19a5295859049a7e0ad?branch=epel9

            Log:
            Update to upstream (bz#2453492)

Fix check_icmp: host-count overflow leads to heap buffer overflow
  in setuid-root binary (bz#2513957)
Remove RHEL7- support

---
diff --git a/.gitignore b/.gitignore
index a5e2418..236eaa9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,4 @@ nagios-plugins-2.3.3.tar.gz
 /nagios-plugins-2.4.8.tar.gz
 /nagios-plugins-2.4.9.tar.gz
 /nagios-plugins-2.4.12.tar.gz
+/nagios-plugins-2.5.tar.gz

diff --git a/nagios-plugins-0020-fix-unsigned-short-overflow.patch b/nagios-plugins-0020-fix-unsigned-short-overflow.patch
new file mode 100644
index 0000000..b530710
--- /dev/null
+++ b/nagios-plugins-0020-fix-unsigned-short-overflow.patch
@@ -0,0 +1,39 @@
+From c94e36bd08d959faf89c9cfe80e082d5c59c3d9f Mon Sep 17 00:00:00 2001
+From: Michael Orlitzky <michael@orlitzky.com>
+Date: Wed, 1 Jul 2026 16:31:41 -0400
+Subject: [PATCH] plugins-root/check_icmp.c: fix unsigned short overflow
+
+The number of targets (hosts) for check_icmp is tallied up, one at a
+time, in
+
+  static unsigned short targets = 0;
+
+When more than USHRT_MAX hosts are specified, check_icmp segfaults
+before dropping privileges. This may be exploitable, and is bad in any
+case. The same issue was recently fixed in monitoring-plugins:
+
+  https://www.openwall.com/lists/oss-security/2026/07/01/5
+
+The two codebases have diverged, but the issue is easy to reproduce in
+nagios-plugins as well. Afterwards, fixing it is a matter of refusing
+to add_target() when there are already USHRT_MAX targets.
+---
+ plugins-root/check_icmp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/plugins-root/check_icmp.c b/plugins-root/check_icmp.c
+index f21228fa..34ea12a1 100644
+--- a/plugins-root/check_icmp.c
++++ b/plugins-root/check_icmp.c
+@@ -1705,6 +1705,11 @@ static int add_target_ip(char *arg, struct sockaddr_storage *in) {
+   struct sockaddr_in *sin = NULL, *host_sin;
+   struct sockaddr_in6 *sin6 = NULL, *host_sin6;
+ 
++  if (targets == USHRT_MAX) {
++    crash("add_target_ip(%s, ...): maximum number of targets (%hu) exceeded",
++	  arg, USHRT_MAX);
++  }
++
+   if (address_family == AF_INET) {
+     sin = (struct sockaddr_in *)in;
+   } else {

diff --git a/nagios-plugins.spec b/nagios-plugins.spec
index cf6489f..106b2a5 100644
--- a/nagios-plugins.spec
+++ b/nagios-plugins.spec
@@ -20,11 +20,11 @@
 %endif
 
 Name: nagios-plugins
-Version: 2.4.12
+Version: 2.5
 %if 0%{?fromgit}
-Release: 6.%{?commdate}git%{?shortcommit}%{?dist}
+Release: 1.%{?commdate}git%{?shortcommit}%{?dist}
 %else
-Release: 6%{?dist}
+Release: 1%{?dist}
 %endif
 
 Summary: Host/service/network monitoring program plugins for Nagios
@@ -46,6 +46,7 @@ Patch1: %{name}-ntpsec-support.patch
 Patch2: nagios-plugins-0002-Remove-assignment-of-not-parsed-to-jitter.patch
 Patch7: nagios-plugins-0007-Fix-the-use-lib-statement-and-the-external-ntp-comma.patch
 Patch12: nagios-plugins-0012-fix-perl-ntp-ipv6.patch
+Patch20: nagios-plugins-0020-fix-unsigned-short-overflow.patch
 
 BuildRequires: make
 BuildRequires: %{_bindir}/mailq
@@ -69,6 +70,11 @@ BuildRequires: libdbi-devel
 Obsoletes: nagios-plugins-dbi < 2.4.0-6
 %endif
 BuildRequires: iputils
+# nagios-plugins isn't compatible with openssl4-devel, use openssl3
+# openssl4-devel is a dependency of net-snmp-devel
+%if 0%{?fedora} >= 45
+BuildRequires: openssl3-devel
+%endif
 BuildRequires: net-snmp-devel
 BuildRequires: net-snmp-utils
 %if 0%{?fedora}
@@ -81,11 +87,7 @@ BuildRequires: perl(Date::Parse)
 BuildRequires: perl(LWP::Simple)
 BuildRequires: perl(Text::Glob)
 BuildRequires: perl-generators
-%if 0%{?rhel} && 0%{?rhel} <= 7
-BuildRequires: postgresql-devel
-%else
 BuildRequires: libpq-devel
-%endif
 BuildRequires: qstat
 BuildRequires: samba-client
 
@@ -602,6 +604,7 @@ Provides check_wave support for Nagios.
 %patch -P 7 -p1 -b .fix_ntpcommands
 %if 0%{?bootstrap} == 0
 %patch -P 12 -p1 -b .fix_perl_ntp
+%patch -P 20 -p1 -b .fix_check_icmp
 %endif
 
 %build
@@ -874,6 +877,12 @@ chmod 644 %{buildroot}/%{_libdir}/nagios/plugins/utils.pm
 %{_libdir}/nagios/plugins/check_wave
 
 %changelog
+* Mon Aug 24 2026 Ján ONDREJ (SAL) <ondrejj(at)salstar.sk> - 2.5-1
+- Update to upstream (bz#2453492)
+- Fix check_icmp: host-count overflow leads to heap buffer overflow
+  in setuid-root binary (bz#2513957)
+- Remove RHEL7- support
+
 * Thu Jul 16 2026 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.12-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
 

diff --git a/sources b/sources
index 5c25c51..7eb2bac 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (nagios-plugins-2.4.12.tar.gz) = fbff697d0cea1cbeb83737f240a42c00e18bf443b8af303b5d7f7f735eb6faa5305d8740fb27472876dc1398735204e0d7a0e5863c2064ec2a37541253f91502
+SHA512 (nagios-plugins-2.5.tar.gz) = c91ede043a393d67299589c8e67496dc23381d804876ab81b6bba2db2ba19a0f786893be0c9b3e009e408c9dfd194ba4fa2d7c1fbc8ca08640e6bcc79942a9dc