SUSE-SU-2023:2187-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2023:2187-1

Related

Published

2023-05-11T17:02:04Z

Modified

2023-05-11T17:02:04Z

Summary

Security update for Prometheus Golang clients

Details

This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:

golang-github-prometheus-alertmanager:

Security issues fixed:
- CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)

golang-github-prometheus-node_exporter:

Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
- CVE-2022-27191: Update go/x/crypto (bsc#1197284)
- CVE-2022-27664: Update go/x/net (bsc#1203185)
- CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):
- NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
- [BUGFIX] Fix hwmon label sanitizer
- [BUGFIX] Use native endianness when encoding InetDiagMsg
- [BUGFIX] Fix btrfs device stats always being zero
- [BUGFIX] Fix diskstats exclude flags
- [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
- [BUGFIX] Fix concurrency issue in ethtool collector
- [BUGFIX] Fix concurrency issue in netdev collector
- [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
- [BUGFIX] Fix iostat on macos broken by deprecation warning
- [BUGFIX] Fix NodeFileDescriptorLimit alerts
- [BUGFIX] Sanitize rapl zone names
- [BUGFIX] Add file descriptor close safely in test
- [BUGFIX] Fix race condition in osrelease.go
- [BUGFIX] bsd: Ignore filesystems flagged as MNTIGNORE
- [BUGFIX] Sanitize UTF-8 in dmi collector
- [CHANGE] Merge metrics descriptions in textfile collector
- [FEATURE] Add multiple listeners and systemd socket listener activation
- [FEATURE] [node-mixin] Add darwin dashboard to mixin
- [FEATURE] Add 'isolated' metric on cpu collector on linux
- [FEATURE] Add cgroup summary collector
- [FEATURE] Add selinux collector
- [FEATURE] Add slab info collector
- [FEATURE] Add sysctl collector
- [FEATURE] Also track the CPU Spin time for OpenBSD systems
- [FEATURE] Add support for MacOS version
- [ENHANCEMENT] Add RTNL version of netclass collector
- [ENHANCEMENT] [node-mixin] Add missing selectors
- [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
- [ENHANCEMENT] [node-mixin] Change disk graph to disk table
- [ENHANCEMENT] [node-mixin] Change io time units to %util
- [ENHANCEMENT] Ad userwiredbytes and laundrybytes on *bsd
- [ENHANCEMENT] Add additional vmstat memory metrics for darwin
- [ENHANCEMENT] Add device filter flags to arp collector
- [ENHANCEMENT] Add diskstats include and exclude device flags
- [ENHANCEMENT] Add nodesoftirqstotal metric
- [ENHANCEMENT] Add rapl zone name label option
- [ENHANCEMENT] Add slabinfo collector
- [ENHANCEMENT] Allow user to select port on NTP server to query
- [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
- [ENHANCEMENT] Enable builds against older macOS SDK
- [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
- [ENHANCEMENT] systemd: Expose systemd minor version
- [ENHANCEMENT] Use netlink for tcpstat collector
- [ENHANCEMENT] Use netlink to get netdev stats
- [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
- [ENHANCEMENT] Add btrfs device error stats
Change build requirement to go1.18 or higher (previously this was fixed to version 1.14)

References

Affected packages

SUSE:Manager Tools 15 / golang-github-prometheus-alertmanager

Package

Name: golang-github-prometheus-alertmanager
Purl: purl:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Tools%2015

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.23.0-150100.4.13.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-alertmanager": "0.23.0-150100.4.13.2"
        }
    ]
}

SUSE:Manager Tools for SLE Micro 5 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Tools%20for%20SLE%20Micro%205

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Module for Basesystem 15 SP4 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Manager Proxy Module 4.2 / golang-github-prometheus-alertmanager

Package

Name: golang-github-prometheus-alertmanager
Purl: purl:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Proxy%20Module%204.2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.23.0-150100.4.13.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-alertmanager": "0.23.0-150100.4.13.2"
        }
    ]
}

SUSE:Manager Proxy Module 4.3 / golang-github-prometheus-alertmanager

Package

Name: golang-github-prometheus-alertmanager
Purl: purl:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Proxy%20Module%204.3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.23.0-150100.4.13.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-alertmanager": "0.23.0-150100.4.13.2"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Real Time 15 SP3 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP1-LTSS / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP2-LTSS / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Server 15 SP3-LTSS / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP1 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP2 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 15 SP3 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Manager Proxy 4.2 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Proxy%204.2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Manager Server 4.2 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Server%204.2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Enterprise Storage 7 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Enterprise%20Storage%207

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

SUSE:Enterprise Storage 7.1 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Enterprise%20Storage%207.1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

openSUSE:Leap 15.4 / golang-github-prometheus-alertmanager

Package

Name: golang-github-prometheus-alertmanager
Purl: purl:rpm/suse/golang-github-prometheus-alertmanager&distro=openSUSE%20Leap%2015.4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.23.0-150100.4.13.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-alertmanager": "0.23.0-150100.4.13.2",
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}

openSUSE:Leap 15.4 / golang-github-prometheus-node_exporter

Package

Name: golang-github-prometheus-node_exporter
Purl: purl:rpm/suse/golang-github-prometheus-node_exporter&distro=openSUSE%20Leap%2015.4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.5.0-150100.3.23.2

Ecosystem specific

{
    "binaries": [
        {
            "golang-github-prometheus-alertmanager": "0.23.0-150100.4.13.2",
            "golang-github-prometheus-node_exporter": "1.5.0-150100.3.23.2"
        }
    ]
}