CVE-2022-31097

Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for a stored Cross Site Scripting in Grafana.

Release v.9.0.3, containing this security fix and other patches:

• Download Grafana 9.0.3
• Release notes

Release v.8.5.9, containing this security fix and other fixes:

• Download Grafana 8.5.9
• Release notes

Release v.8.4.10, containing this security fix and other fixes:

• Download Grafana 8.4.10
• Release notes

Release v.8.3.10, containing this security fix and other fixes:

• Download Grafana 8.3.10

Stored XSS (CVE-2022-31097)

Summary

On June 19 a security researcher contacted Grafana Labs to disclose a XSS vulnerability in the Unified Alerting feature of Grafana. After analysis, this stored XSS could be used to elevate privileges from Editor to Admin.

We believe that this vulnerability is rated at CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).

Impact

An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link.

Affected versions with HIGH severity

All Grafana >=8.0 versions are affected by this vulnerability.

Solutions and mitigations

All installations after Grafana v8.0 should be upgraded as soon as possible.

As a workaround it is possible to disable alerting or use legacy alerting.

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana.

Timeline

Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.

2022-06-19 10:32 - Research submission of vulnerability report 2022-06-20 14:35- Issue triaged, confirmed positive, and internal incident raised 2022-06-20 18:40 - Fix PR submitted and reviewed 2022-06-23 07:12 - All Grafana Cloud hosted Grafana instances patched 2022-07-05 07:14 - Customers informed under embargo 2022-07-14 02:00 - Public release

Acknowledgement

We would like to thank Maxim Misharin for responsibly disclosing the vulnerability.

Reporting security issues

If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.(CVE-2022-31097)

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.(CVE-2022-31130)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/(CVE-2022-35957)

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.(CVE-2022-36062)

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.(CVE-2022-39201)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows…

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.(CVE-2022-31097)

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.(CVE-2022-31130)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/(CVE-2022-35957)

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.(CVE-2022-36062)

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.(CVE-2022-39201)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows…

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.(CVE-2022-31097)

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.(CVE-2022-31130)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/(CVE-2022-35957)

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.(CVE-2022-36062)

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.(CVE-2022-39201)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows…

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.(CVE-2022-31097)

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana authentication token. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not use API keys, JWT authentication, or any HTTP Header based authentication.(CVE-2022-31130)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/(CVE-2022-35957)

Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation of Permissions resulting in privilege escalation on some folders where Admin is the only used permission. The vulnerability impacts Grafana instances where RBAC was disabled and enabled afterwards, as the migrations which are translating legacy folder permissions to RBAC permissions do not account for the scenario where the only user permission in the folder is Admin, as a result RBAC adds permissions for Editors and Viewers which allow them to edit and view folders accordingly. This issue has been patched in versions 8.5.13, 9.0.9, and 9.1.6. A workaround when the impacted folder/dashboard is known is to remove the additional permissions manually.(CVE-2022-36062)

Grafana is an open source observability and data visualization platform. Starting with version 5.0.0-beta1 and prior to versions 8.5.14 and 9.1.8, Grafana could leak the authentication cookie of users to plugins. The vulnerability impacts data source and plugin proxy endpoints under certain conditions. The destination plugin could receive a user's Grafana authentication cookie. Versions 9.1.8 and 8.5.14 contain a patch for this issue. There are no known workarounds.(CVE-2022-39201)

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.2.4, or 8.5.15 on the 8.X branch, are subject to Improper Input Validation. Grafana admins can invite other members to the organization they are an admin for. When admins add members to the organization, non existing users get an email invite, existing members are added directly to the organization. When an invite link is sent, it allows…

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.

Grafana Stored Cross-site Scripting in Unified Alerting in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v8.0.0 before v8.3.10, from v8.4.0 before v8.4.10, from v8.5.0 before v8.5.9, from v9.0.0 before v9.0.3.

These are all security issues fixed in the grafana-8.3.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Updated to version 8.5.13 (jsc#PED-2145, jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565):

• CVE-2022-36062: Fixed RBAC folders/dashboards privilege escalation (bsc#1203596).
• CVE-2022-35957: Fixed escalation from admin to server admin when auth proxy is used (bsc#1203597).
• CVE-2022-31107: Fixed OAuth account takeover (bsc#1201539).
• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-21702: Fixed XSS vulnerability in handling data sources (bsc#1195726).
• CVE-2022-21703: Fixed cross-origin request forgery vulnerability (bsc#1195727).
• CVE-2022-21713: Fixed Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728).
• CVE-2022-21673: Fixed missing error return in GetUserInfo if no user was found (bsc#1194873).
• CVE-2021-43815: Fixed directory traversal for .csv files (bsc#1193686).
• CVE-2021-41244: Fixed incorrect access control vulnerability(bsc#1192763).
• CVE-2021-41174: Fixed XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL (bsc#1192383).
• CVE-2021-3711: Fixed SM2 Decryption Buffer Overflow (bsc#1189520).
• CVE-2021-36222: Fixed a null pointer dereference in the KDC (bsc#1188571).
• CVE-2021-43798: Fixed arbitrary file read in the graph native plugin (bsc#1193492).

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not include sources (bsc#1200725)

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter. (bsc#1196338, jsc#SLE-24243, jsc#SUMA-114)

grafana:

• Update to version 8.3.10
  • Security:
    • CVE-2022-31097: Cross Site Scripting vulnerability in the Unified Alerting (bsc#1201535)
    • CVE-2022-31107: OAuth account takeover vulnerability (bsc#1201539)
• Update to version 8.3.9
  • Bug fixes:
    • Geomap: Display legend
    • Prometheus: Fix timestamp truncation
• Update to version 8.3.7
  • Bug fix:
    • Provisioning: Ensure that the default value for orgID is set when provisioning datasources to be deleted.
• Update to version 8.3.6
  • Features and enhancements:
    • Cloud Monitoring: Reduce request size when listing labels.
    • Explore: Show scalar data result in a table instead of graph.
    • Snapshots: Updates the default external snapshot server URL.
    • Table: Makes footer not overlap table content.
    • Tempo: Add request histogram to service graph datalink.
    • Tempo: Add time range to tempo search query behind a feature flag.
    • Tempo: Auto-clear results when changing query type.
    • Tempo: Display start time in search results as relative time.
    • CloudMonitoring: Fix resource labels in query editor.
    • Cursor sync: Apply the settings without saving the dashboard.
    • LibraryPanels: Fix for Error while cleaning library panels.
    • Logs Panel: Fix timestamp parsing for string dates without timezone.
    • Prometheus: Fix some of the alerting queries that use reduce/math operation.
    • TablePanel: Fix ad-hoc variables not working on default datasources.
    • Text Panel: Fix alignment of elements.
    • Variables: Fix for constant variables in self referencing links.
• Update to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565)

kiwi-desc-saltboot:

• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Use salt bundle
  • Add support fo VirtIO disks

mgr-daemon:

• Version 4.3.6-1
  • Update translation strings

spacecmd:

• Version 4.3.15-1
  • Process date values in spacecmd api calls (bsc#1198903)

spacewalk-client-tools:

• Version 4.3.12-1
  • Update translation strings

uyuni-common-libs:

• Version 4.3.6-1
  • Do not allow creating path if nonexistent user or group in fileutils.

This update fixes the following issues:

dracut-saltboot:

• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle

golang-github-lusitaniae-apache_exporter:

• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add %license macro for LICENSE file

grafana:

• Update to version 8.3.10
  • Security:
    • CVE-2022-31097: Cross Site Scripting vulnerability in the Unified Alerting (bsc#1201535)
    • CVE-2022-31107: Fixes OAuth account takeover vulnerability (bsc#1201539)
• Update to version 8.3.9
  • Bug fixes:
    • Geomap: Display legend
    • Prometheus: Fix timestamp truncation
• Update to version 8.3.7
  • Bug fix:
    • Provisioning: Ensure that the default value for orgID is set when provisioning datasources to be deleted.
• Update to version 8.3.6
  • Features and enhancements:
    • Cloud Monitoring: Reduce request size when listing labels.
    • Explore: Show scalar data result in a table instead of graph.
    • Snapshots: Updates the default external snapshot server URL.
    • Table: Makes footer not overlap table content.
    • Tempo: Add request histogram to service graph datalink.
    • Tempo: Add time range to tempo search query behind a feature flag.
    • Tempo: Auto-clear results when changing query type.
    • Tempo: Display start time in search results as relative time.
    • CloudMonitoring: Fix resource labels in query editor.
    • Cursor sync: Apply the settings without saving the dashboard.
    • LibraryPanels: Fix for Error while cleaning library panels.
    • Logs Panel: Fix timestamp parsing for string dates without timezone.
    • Prometheus: Fix some of the alerting queries that use reduce/math operation.
    • TablePanel: Fix ad-hoc variables not working on default datasources.
    • Text Panel: Fix alignment of elements.
    • Variables: Fix for constant variables in self referencing links.
• Update to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565)

mgr-daemon:

• Version 4.3.6-1
  • Update translation strings

spacecmd:

• Version 4.3.15-1
  • Process date values in spacecmd api calls (bsc#1198903)

spacewalk-client-tools:

• Version 4.3.12-1
  • Update translation strings

uyuni-common-libs:

• Version 4.3.6-1
  • Do not allow creating path if nonexistent user or group in fileutils.

This update for grafana fixes the following issues:

Updated to version 8.3.10 (jsc#SLE-24565, jsc#SLE-23422, jsc#SLE-23439):

• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-31107: Fixed OAuth account takeover vulnerability (bsc#1201539).
• CVE-2022-21702: Fixed XSS through attacker-controlled data source (bsc#1195726).
• CVE-2022-21703: Fixed Cross Site Request Forgery (bsc#1195727).
• CVE-2022-21713: Fixed Teams API IDOR (bsc#1195728).

This update for grafana fixes the following issues:

Version update from 8.3.10 to 8.5.13 (jsc#PED-2145):

• Security fixes:

  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)

• Features and enhancements:

  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to api/ds/query
  • Rendering: Add support for renderer token
  • Setting: Support configuring feature toggles…

This update fixes the following issues:

dracut-saltboot:

• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8.

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins …

This update fixes the following issues:

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to…

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

bind:

• Provide bind dependencies and solve installation issues on SUSE Linux Enterprise Micro
• There are no source changes

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from…

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

ansible:

• Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
  • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
  • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
• Update to 2.9.22:
  • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
  • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)
• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Copy existing wicked config instead of generating new (bsc#1205599)
• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images
• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle
• Require e2fsprogs (bsc#1202614)
• Update to version 0.1.1657643023.0d694ce
  • Update dracut-saltboot dependencies (bsc#1200970)
  • Fix network loading when ipappend is used in pxe config
  • Add new information messages

golang-github-QubitProducts-exporter_exporter:

• Remove license file from %doc
• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Spec file clean up
• Fix apparmor profile for SLE 12
• Do not build with apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build with Go 1.19
• Build using promu
• Add _service file
• Fix sandboxing options
• Upgrade to version 0.13.4
  • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
• Upgrade to version 0.13.3
  • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

• Update to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API:…