CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

Database specific

{
    "cwe_ids": [
        "CWE-287",
        "CWE-303"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46146.json"
}

References

Affected packages

Git / github.com/prometheus/exporter-toolkit

Affected ranges

Type

GIT

Repo

https://github.com/prometheus/exporter-toolkit

Events

Introduced

Fixed

25288779bc59d00c41b4a1706c6b87f0561ef2d7

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.7.2"
        }
    ]
}

Type

GIT

Repo

https://github.com/prometheus/exporter-toolkit

Events

Introduced

7cedc3cfb233bd238c0b1a3675385d0518d3d3c5

Fixed

5b1eab34484ddd353986bce736cd119d863e4ff5

Database specific

{
    "versions": [
        {
            "introduced": "0.8.0"
        },
        {
            "fixed": "0.8.2"
        }
    ]
}

Affected versions

v0.*

v0.1.0

v0.2.0

v0.3.0

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.7.1

v0.8.0

v0.8.1