SUSE-SU-2024:0486-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2024:0486-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2024:0486-1
- Related
- Published
- 2024-02-15T13:35:33Z
- Modified
- 2024-02-15T13:35:33Z
- Summary
- Security update for SUSE Manager Client Tools
- Details
-
This update fixes the following issues:
golang-github-lusitaniae-apache_exporter:
- Do not strip if SUSE Linux Enterprise 15 SP3
- Exclude debug for Red Hat Enterprise Linux >= 8
- Build with Go >= 1.20 when the OS is not Red Hat Enterprise Linux
golang-github-prometheus-alertmanager:
- Create position independent executables (PIE)
- Add System/Monitoring group tag
- Update to version 0.26.0 (jsc#PED-7353):
https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
- CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
- Configuration: Fix empty list of receivers and inhibitrules would cause the alertmanager to crash
- Templating: Fixed a race condition when using the title function. It is now race-safe
- API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
- API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
- Clustering: Fixes a panic when tlsclientconfig is empty
- Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
- Metrics: New label reason for alertmanagernotificationsfailedtotal metric to indicate the type of error of the alert delivery
- Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
- Integrations: Add Microsoft Teams as a supported integration
- Update to version 0.25.0:
https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
- Fail configuration loading if apikey and apikeyfile are defined at the same time
- Fix the alertmanageralerts metric to avoid counting resolved alerts as active. Also added a new alertmanagermarkedalerts metric that retain the old behavior
- Trim contents of Slack API URLs when reading from files
- amtool: Avoid panic when the label value matcher is empty
- Fail configuration loading if apiurl is empty for OpsGenie
- Fix email template for resolved notifications
- Add proxyurl support for OAuth2 in HTTP client configuration
- Reload TLS certificate and key from disk when updated
- Add Discord integration
- Add Webex integration
- Add minversion support to select the minimum TLS version in HTTP client configuration
- Add maxversion support to select the maximum TLS version in
- Emit warning logs when truncating messages in notifications
- Support HEAD method for the /-/healty and /-/ready endpoints
- Add support for reading global and local SMTP passwords from files
- UI: Add 'Link' button to alerts in list
- UI: Allow to choose the first day of the week as Sunday or Monday
- Update to version 0.24.0:
https://github.com/prometheus/alertmanager/releases/tag/v0.24.0
- Fix HTTP client configuration for the SNS receiver
- Fix unclosed file descriptor after reading the silences snapshot file
- Fix field names for mutetimeintervals in JSON marshaling
- Ensure that the root route doesn't have any matchers
- Truncate the message's title to 1024 chars to avoid hitting Slack limits
- Fix the default HTML email template (email.default.html) to match with the canonical source
- Detect SNS FIFO topic based on the rendered value
- Avoid deleting and recreating a silence when an update is possible
- api/v2: Return 200 OK when deleting an expired silence
- amtool: Fix the silence's end date when adding a silence. The end date is (start date + duration) while it used to be (current time + duration). The new behavior is consistent with the update operation
- Add the /api/v2 prefix to all endpoints in the OpenAPI specification and generated client code
- Add --cluster.tls-config experimental flag to secure cluster traffic via mutual TLS
- Add Telegram integration
mgr-daemon:
- Version 4.3.8-1
- Update translation strings
prometheus-postgres_exporter:
- Remove duplicated call to systemd requirements
- Do not build debug if Red Hat Enterprise Linux >= 8
- Do not strip if SUSE Linux Enterprise 15 SP3
- Build at least with with Go >= 1.18 on Red Hat Enterprise Linux
- Build with Go >= 1.20 elsewhere
spacecmd:
- Version 4.3.26-1
- Update translation strings
spacewalk-client-tools:
- Version 4.3.18-1
- Update translation strings
- References
-
- https://www.suse.com/support/update/announcement/2024/suse-su-20240486-1/
- https://bugzilla.suse.com/1192154
- https://bugzilla.suse.com/1192696
- https://bugzilla.suse.com/1193492
- https://bugzilla.suse.com/1193686
- https://bugzilla.suse.com/1200480
- https://bugzilla.suse.com/1204023
- https://bugzilla.suse.com/1218838
- https://bugzilla.suse.com/1218843
- https://bugzilla.suse.com/1218844
- https://www.suse.com/security/cve/CVE-2020-7753
- https://www.suse.com/security/cve/CVE-2021-3807
- https://www.suse.com/security/cve/CVE-2021-3918
- https://www.suse.com/security/cve/CVE-2021-43138
- https://www.suse.com/security/cve/CVE-2021-43798
- https://www.suse.com/security/cve/CVE-2021-43815
- https://www.suse.com/security/cve/CVE-2022-0155
- https://www.suse.com/security/cve/CVE-2022-41715
- https://www.suse.com/security/cve/CVE-2023-40577
Affected packages
SUSE:Manager Tools 12 / golang-github-lusitaniae-apache_exporter
Package
- Name
- golang-github-lusitaniae-apache_exporter
- Purl
- purl:rpm/suse/golang-github-lusitaniae-apache_exporter&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.0.0-1.21.2
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}
SUSE:Manager Tools 12 / golang-github-prometheus-alertmanager
Package
- Name
- golang-github-prometheus-alertmanager
- Purl
- purl:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.26.0-1.24.2
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}
SUSE:Manager Tools 12 / golang-github-prometheus-prometheus
Package
- Name
- golang-github-prometheus-prometheus
- Purl
- purl:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.45.0-1.50.2
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}
SUSE:Manager Tools 12 / grafana
Package
- Name
- grafana
- Purl
- purl:rpm/suse/grafana&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed9.5.8-1.60.1
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}
SUSE:Manager Tools 12 / mgr-daemon
Package
- Name
- mgr-daemon
- Purl
- purl:rpm/suse/mgr-daemon&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.3.8-1.44.2
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}
SUSE:Manager Tools 12 / prometheus-postgres_exporter
Package
- Name
- prometheus-postgres_exporter
- Purl
- purl:rpm/suse/prometheus-postgres_exporter&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed0.10.1-1.17.2
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}
SUSE:Manager Tools 12 / spacecmd
Package
- Name
- spacecmd
- Purl
- purl:rpm/suse/spacecmd&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.3.26-38.136.2
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}
SUSE:Manager Tools 12 / spacewalk-client-tools
Package
- Name
- spacewalk-client-tools
- Purl
- purl:rpm/suse/spacewalk-client-tools&distro=SUSE%20Manager%20Tools%2012
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed4.3.18-52.95.2
Ecosystem specific
{
"binaries": [
{
"python2-spacewalk-client-tools": "4.3.18-52.95.2",
"spacewalk-client-setup": "4.3.18-52.95.2",
"golang-github-prometheus-prometheus": "2.45.0-1.50.2",
"golang-github-lusitaniae-apache_exporter": "1.0.0-1.21.2",
"spacewalk-check": "4.3.18-52.95.2",
"prometheus-postgres_exporter": "0.10.1-1.17.2",
"python2-spacewalk-check": "4.3.18-52.95.2",
"golang-github-prometheus-alertmanager": "0.26.0-1.24.2",
"python2-spacewalk-client-setup": "4.3.18-52.95.2",
"spacewalk-client-tools": "4.3.18-52.95.2",
"mgr-daemon": "4.3.8-1.44.2",
"spacecmd": "4.3.26-38.136.2",
"grafana": "9.5.8-1.60.1"
}
]
}