CVE-2023-45142

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

Summary

This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65 out of the box adds labels

• http.user_agent
• http.method

that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it.

Details

HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent.

PoC

Send many requests with long randomly generated HTTP methods or/and User agents (e.g. a million) and observe how memory consumption increases during it.

Impact

In order to be affected, the program has to configure a metrics pipeline, use otelhttp.NewHandler wrapper, and does not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc.

Others

It is similar to already reported vulnerabilities

• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh (open-telemetry/opentelemetry-go-contrib)
• https://github.com/advisories/GHSA-cg3q-j54f-5p7p (prometheus/client_golang)

Workaround for affected versions

As a workaround to stop being affected otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely.

For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

The other possibility is to disable HTTP metrics instrumentation by passing otelhttp.WithMeterProvider option with noop.NewMeterProvider.

Solution provided by upgrading

In PR https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277, released with package version 0.44.0, the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed.

References

• https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277
• https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

Memory exhaustion in go.opentelemetry.io/contrib/instrumentation

This update for caddy fixes the following issues:

Update to version 2.8.4:

• cmd: fix regression in auto-detect of Caddyfile (#6362)
• Tag v2.8.3 was mistakenly made on the v2.8.2 commit and is skipped

Update to version 2.8.2:

• cmd: fix auto-detetction of .caddyfile extension (#6356)
• caddyhttp: properly sanitize requests for root path (#6360)
• caddytls: Implement certmagic.RenewalInfoGetter

Update to version 2.8.1:

• caddyhttp: Fix merging consecutive client_ip or remote_ip matchers (#6350)
• core: MkdirAll appDataDir in InstanceID with 0o700 (#6340)

Update to version 2.8.0:

• acmeserver: Add sign_with_root for Caddyfile (#6345)
• caddyfile: Reject global request matchers earlier (#6339)
• core: Fix bug in AppIfConfigured (fix #6336)
• fix a typo (#6333)
• autohttps: Move log WARN to INFO, reduce confusion (#6185)
• reverseproxy: Support HTTP/3 transport to backend (#6312)
• context: AppIfConfigured returns error; consider not-yet-provisioned modules (#6292)
• Fix lint error about deprecated method in smallstep/certificates/authority
• go.mod: Upgrade dependencies
• caddytls: fix permission requirement with AutomationPolicy (#6328)
• caddytls: remove ClientHelloSNICtxKey (#6326)
• caddyhttp: Trace individual middleware handlers (#6313)
• templates: Add pathEscape template function and use it in file browser (#6278)
• caddytls: set server name in context (#6324)
• chore: downgrade minimum Go version in go.mod (#6318)
• caddytest: normalize the JSON config (#6316)
• caddyhttp: New experimental handler for intercepting responses (#6232)
• httpcaddyfile: Set challenge ports when http_port or https_port are used
• logging: Add support for additional logger filters other than hostname (#6082)
• caddyhttp: Log 4xx as INFO; 5xx as ERROR (close #6106)
• caddyhttp: Alter log message when request is unhandled (close #5182)
• reverseproxy: Pointer to struct when loading modules; remove LazyCertPool (#6307)
• tracing: add trace_id var (http.vars.trace_id placeholder) (#6308)
• go.mod: CertMagic v0.21.0
• reverseproxy: Implement health_follow_redirects (#6302)
• caddypki: Allow use of root CA without a key. Fixes #6290 (#6298)
• go.mod: Upgrade to quic-go v0.43.1
• reverseproxy: HTTP transport: fix PROXY protocol initialization (#6301)
• caddytls: Ability to drop connections (close #6294)
• httpcaddyfile: Fix expression matcher shortcut in snippets (#6288)
• caddytls: Evict internal certs from cache based on issuer (#6266)
• chore: add warn logs when using deprecated fields (#6276)
• caddyhttp: Fix linter warning about deprecation
• go.mod: Upgrade to quic-go v0.43.0
• fileserver: Set 'Vary: Accept-Encoding' header (see #5849)
• events: Add debug log
• reverseproxy: handle buffered data during hijack (#6274)
• ci: remove android and plan9 from cross-build workflow (#6268)
• run golangci-lint run --fix --fast (#6270)
• caddytls: Option to configure certificate lifetime (#6253)
• replacer: Implement file.* global replacements (#5463)
• caddyhttp: Address some Go 1.20 features (#6252)
• Quell linter (false positive)
• reverse_proxy: Add grace_period for SRV upstreams to Caddyfile (#6264)
• doc: add verifier in ClientAuthentication caddyfile marshaler doc (#6263)
• caddytls: Add Caddyfile support for on-demand permission module (close #6260)
• reverseproxy: Remove long-deprecated buffering properties
• reverseproxy: Reuse buffered request body even if partially drained
• reverseproxy: Accept EOF when buffering
• logging: Fix default access logger (#6251)
• fileserver: Improve Vary handling (#5849)
• cmd: Only validate config is proper JSON if config slice has data (#6250)
• staticresp: Use the evaluated response body for sniffing JSON content-type (#6249)
• encode: Slight fix for the previous commit
• encode: Improve Etag handling (fix #5849)
• httpcaddyfile: Skip automate loader if…

This update for caddy fixes the following issues:

• Update to version 2.8.4:

  • cmd: fix regression in auto-detect of Caddyfile (#6362)
  • Tag v2.8.3 was mistakenly made on the v2.8.2 commit and is skipped

• Update to version 2.8.2:

  • cmd: fix auto-detetction of .caddyfile extension (#6356)
  • caddyhttp: properly sanitize requests for root path (#6360)
  • caddytls: Implement certmagic.RenewalInfoGetter
  • build(deps): bump golangci/golangci-lint-action from 5 to 6 (#6361)

• Update to version 2.8.1:

  • caddyhttp: Fix merging consecutive client_ip or remote_ip matchers (#6350)
  • core: MkdirAll appDataDir in InstanceID with 0o700 (#6340)

• Update to version 2.8.0:

  • acmeserver: Add sign_with_root for Caddyfile (#6345)
  • caddyfile: Reject global request matchers earlier (#6339)
  • core: Fix bug in AppIfConfigured (fix #6336)
  • fix a typo (#6333)
  • autohttps: Move log WARN to INFO, reduce confusion (#6185)
  • reverseproxy: Support HTTP/3 transport to backend (#6312)
  • context: AppIfConfigured returns error; consider not-yet-provisioned modules (#6292)
  • Fix lint error about deprecated method in smallstep/certificates/authority
  • go.mod: Upgrade dependencies
  • caddytls: fix permission requirement with AutomationPolicy (#6328)
  • caddytls: remove ClientHelloSNICtxKey (#6326)
  • caddyhttp: Trace individual middleware handlers (#6313)
  • templates: Add pathEscape template function and use it in file browser (#6278)
  • caddytls: set server name in context (#6324)
  • chore: downgrade minimum Go version in go.mod (#6318)
  • caddytest: normalize the JSON config (#6316)
  • caddyhttp: New experimental handler for intercepting responses (#6232)
  • httpcaddyfile: Set challenge ports when http_port or https_port are used
  • logging: Add support for additional logger filters other than hostname (#6082)
  • caddyhttp: Log 4xx as INFO; 5xx as ERROR (close #6106)
  • Second half of 6dce493
  • caddyhttp: Alter log message when request is unhandled (close #5182)
  • chore: Bump Go version in CI (#6310)
  • go.mod: go 1.22.3
  • Fix typos (#6311)
  • reverseproxy: Pointer to struct when loading modules; remove LazyCertPool (#6307)
  • tracing: add trace_id var (http.vars.trace_id placeholder) (#6308)
  • go.mod: CertMagic v0.21.0
  • reverseproxy: Implement health_follow_redirects (#6302)
  • caddypki: Allow use of root CA without a key. Fixes #6290 (#6298)
  • go.mod: Upgrade to quic-go v0.43.1
  • reverseproxy: HTTP transport: fix PROXY protocol initialization (#6301)
  • caddytls: Ability to drop connections (close #6294)
  • build(deps): bump golangci/golangci-lint-action from 4 to 5 (#6289)
  • httpcaddyfile: Fix expression matcher shortcut in snippets (#6288)
  • caddytls: Evict internal certs from cache based on issuer (#6266)
  • chore: add warn logs when using deprecated fields (#6276)
  • caddyhttp: Fix linter warning about deprecation
  • go.mod: Upgrade to quic-go v0.43.0
  • fileserver: Set 'Vary: Accept-Encoding' header (see #5849)
  • events: Add debug log
  • reverseproxy: handle buffered data during hijack (#6274)
  • ci: remove android and plan9 from cross-build workflow (#6268)
  • run golangci-lint run --fix --fast (#6270)
  • caddytls: Option to configure certificate lifetime (#6253)
  • replacer: Implement file.* global replacements (#5463)
  • caddyhttp: Address some Go 1.20 features (#6252)
  • Quell linter (false positive)
  • reverse_proxy: Add grace_period for SRV upstreams to Caddyfile (#6264)
  • doc: add verifier in ClientAuthentication caddyfile marshaler doc (#6263)
  • caddytls: Add Caddyfile support for on-demand permission module (close #6260)
  • reverseproxy: Remove long-deprecated buffering properties
  • reverseproxy: Reuse buffered request body even if partially drained
  • reverseproxy: Accept EOF when buffering
  • logging: Fix default access logger (#6251)
  • fileserver: Improve Vary handling (#5849)
  • cmd: Only validate config is proper…

These are all security issues fixed in the teleport-14.1.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the caddy-2.7.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-prometheus-prometheus-2.53.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerd-1.7.21-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-26.1.5_ce-2.1 package on the GA media of openSUSE Tumbleweed.

This update for containerd fixes the following issues:

• Update to containerd v1.7.21
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)
• CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)

This update for containerd fixes the following issues:

• Update to containerd v1.7.21
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)
• CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)

This update fixes the following issues:

golang-github-prometheus-prometheus:

• Security issues fixed:

  • CVE-2024-6104: Update go-retryablehttp to version 0.7.7 (bsc#1227038)
  • CVE-2023-45142: Updated otelhttp to version 0.46.1 (bsc#1228556)

• Require Go > 1.20 for building

• Migrate from disabled to manual service mode

• Update to 2.45.6 (jsc#PED-3577):

  • Security fixes in dependencies

• Update to 2.45.5:

  • [BUGFIX] tsdb/agent: ensure that new series get written to WAL on rollback.
  • [BUGFIX] Remote write: Avoid a race condition when applying configuration.

• Update to 2.45.4:

  • [BUGFIX] Remote read: Release querier resources before encoding the results.

• Update to 2.45.3:

  • [BUGFIX] TSDB: Remove double memory snapshot on shutdown.

• Update to 2.45.2:

  • [BUGFIX] TSDB: Fix PostingsForMatchers race with creating new series.

• Update to 2.45.1:

  • [ENHANCEMENT] Hetzner SD: Support larger ID's that will be used by Hetzner in September.
  • [BUGFIX] Linode SD: Cast InstanceSpec values to int64 to avoid overflows on 386 architecture.
  • [BUGFIX] TSDB: Handle TOC parsing failures.

rhnlib:

• Version 5.0.4-0
  • Add the old TLS code for very old traditional clients still on python 2.7 (bsc#1228198)

spacecmd:

• Version 5.0.9-0
  • Update translation strings

uyuni-tools:

• Version 0.1.21-0
  • mgrpxy: Fix typo on Systemd template
• Version 0.1.20-0
  • Update the push tag to 5.0.1
  • mgrpxy: expose port on IPv6 network (bsc#1227951)
• Version 0.1.19-0
  • Skip updating Tomcat remote debug if conf file is not present
• Version 0.1.18-0
  • Setup Confidential Computing container during migration (bsc#1227588)
  • Add the /etc/uyuni/uyuni-tools.yaml path to the config help
  • Split systemd config files to not loose configuration at upgrade (bsc#1227718)
  • Use the same logic for image computation in mgradm and mgrpxy (bsc#1228026)
  • Allow building with different Helm and container default registry paths (bsc#1226191)
  • Fix recursion in mgradm upgrade podman list --help
  • Setup hub xmlrpc API service in migration to Podman (bsc#1227588)
  • Setup disabled hub xmlrpc API service in all cases (bsc#1227584)
  • Clean the inspection code to make it faster
  • Properly detect IPv6 enabled on Podman network (bsc#1224349)
  • Fix the log file path generation
  • Write scripts output to uyuni-tools.log file
  • Add uyuni-hubxml-rpc to the list of values in mgradm scale --help
  • Use path in mgradm support sql file input (bsc#1227505)
  • On Ubuntu build with go1.21 instead of go1.20
  • Enforce Cobbler setup (bsc#1226847)
  • Expose port on IPv6 network (bsc#1227951)
  • show output of podman image search --list-tags command
  • Implement mgrpxy support config command
  • During migration, ignore /etc/sysconfig/tomcat and /etc/tomcat/tomcat.conf (bsc#1228183)
  • During migration, remove java.annotation,com.sun.xml.bind and UseConcMarkSweepGC settings
  • Disable node exporter port for Kubernetes
  • Fix start, stop and restart in Kubernetes
  • Increase start timeout in Kubernetes
  • Fix traefik query
  • Fix password entry usability (bsc#1226437)
  • Add --prepare option to migrate command
  • Fix random error during installation of CA certificate (bsc#1227245)
  • Clarify and fix distro name guessing when not provided (bsc#1226284)
  • Replace not working Fatal error by plain error return (bsc#1220136)
  • Allow server installation with preexisting storage volumes
  • Do not report error when purging mounted volume (bsc#1225349)
  • Preserve PAGER settings from the host for interactive sql usage (bsc#1226914)
  • Add mgrpxy command to clear the Squid cache
  • Use local images for Confidential Computing and Hub containers (bsc#1227586)
• Version 0.1.17-0
  • Allow GPG files to be loaded from the local file (bsc#1227195)
• Version 0.1.16-0
  • Prefer local images in all migration steps (bsc#1227244)
• Version 0.1.15-0 *…

This update fixes the following issues:

golang-github-prometheus-prometheus:

• Security issues fixed:

  • CVE-2024-6104: Update go-retryablehttp to version 0.7.7 (bsc#1227038)
  • CVE-2023-45142: Updated otelhttp to version 0.46.1 (bsc#1228556)

• Require Go > 1.20 for building

• Migrate from disabled to manual service mode

• Update to 2.45.6 (jsc#PED-3577):

  • Security fixes in dependencies

• Update to 2.45.5:

  • [BUGFIX] tsdb/agent: ensure that new series get written to WAL on rollback.
  • [BUGFIX] Remote write: Avoid a race condition when applying configuration.

• Update to 2.45.4:

  • [BUGFIX] Remote read: Release querier resources before encoding the results.

• Update to 2.45.3:

  • [BUGFIX] TSDB: Remove double memory snapshot on shutdown.

• Update to 2.45.2:

  • [BUGFIX] TSDB: Fix PostingsForMatchers race with creating new series.

• Update to 2.45.1:

  • [ENHANCEMENT] Hetzner SD: Support larger ID's that will be used by Hetzner in September.
  • [BUGFIX] Linode SD: Cast InstanceSpec values to int64 to avoid overflows on 386 architecture.
  • [BUGFIX] TSDB: Handle TOC parsing failures.

rhnlib:

• Version 5.0.4-0
  • Add the old TLS code for very old traditional clients still on python 2.7 (bsc#1228198)

spacecmd:

• Version 5.0.9-0
  • Update translation strings

uyuni-tools:

• Version 0.1.21-0
  • mgrpxy: Fix typo on Systemd template
• Version 0.1.20-0
  • Update the push tag to 5.0.1
  • mgrpxy: expose port on IPv6 network (bsc#1227951)
• Version 0.1.19-0
  • Skip updating Tomcat remote debug if conf file is not present
• Version 0.1.18-0
  • Setup Confidential Computing container during migration (bsc#1227588)
  • Add the /etc/uyuni/uyuni-tools.yaml path to the config help
  • Split systemd config files to not loose configuration at upgrade (bsc#1227718)
  • Use the same logic for image computation in mgradm and mgrpxy (bsc#1228026)
  • Allow building with different Helm and container default registry paths (bsc#1226191)
  • Fix recursion in mgradm upgrade podman list --help
  • Setup hub xmlrpc API service in migration to Podman (bsc#1227588)
  • Setup disabled hub xmlrpc API service in all cases (bsc#1227584)
  • Clean the inspection code to make it faster
  • Properly detect IPv6 enabled on Podman network (bsc#1224349)
  • Fix the log file path generation
  • Write scripts output to uyuni-tools.log file
  • Add uyuni-hubxml-rpc to the list of values in mgradm scale --help
  • Use path in mgradm support sql file input (bsc#1227505)
  • On Ubuntu build with go1.21 instead of go1.20
  • Enforce Cobbler setup (bsc#1226847)
  • Expose port on IPv6 network (bsc#1227951)
  • show output of podman image search --list-tags command
  • Implement mgrpxy support config command
  • During migration, ignore /etc/sysconfig/tomcat and /etc/tomcat/tomcat.conf (bsc#1228183)
  • During migration, remove java.annotation,com.sun.xml.bind and UseConcMarkSweepGC settings
  • Disable node exporter port for Kubernetes
  • Fix start, stop and restart in Kubernetes
  • Increase start timeout in Kubernetes
  • Fix traefik query
  • Fix password entry usability (bsc#1226437)
  • Add --prepare option to migrate command
  • Fix random error during installation of CA certificate (bsc#1227245)
  • Clarify and fix distro name guessing when not provided (bsc#1226284)
  • Replace not working Fatal error by plain error return (bsc#1220136)
  • Allow server installation with preexisting storage volumes
  • Do not report error when purging mounted volume (bsc#1225349)
  • Preserve PAGER settings from the host for interactive sql usage (bsc#1226914)
  • Add mgrpxy command to clear the Squid cache
  • Use local images for Confidential Computing and Hub containers (bsc#1227586)
• Version 0.1.17-0
  • Allow GPG files to be loaded from the local file (bsc#1227195)
• Version 0.1.16-0
  • Prefer local images in all migration steps (bsc#1227244)
• Version 0.1.15-0 *…

This update for golang-github-prometheus-prometheus fixes the following issues:

• Require Go > 1.20 for building

• Bump go-retryablehttp to version 0.7.7 (CVE-2024-6104, bsc#1227038)

• Migrate from disabled to manual service mode

• Add0003-Bump-go-retryablehttp.patch

• Update to 2.45.6 (jsc#PED-3577):

  • Security fixes in dependencies

• Update to 2.45.5:

  • [BUGFIX] tsdb/agent: ensure that new series get written to WAL on rollback.
  • [BUGFIX] Remote write: Avoid a race condition when applying configuration.

• Update to 2.45.4:

  • [BUGFIX] Remote read: Release querier resources before encoding the results.

• Update to 2.45.3:

  • Security fixes in dependencies
  • [BUGFIX] TSDB: Remove double memory snapshot on shutdown.

• Update to 2.45.2:

  • Security fixes in dependencies
  • [SECURITY] Updated otelhttp to version 0.46.1 (CVE-2023-45142, bsc#1228556)
  • [BUGFIX] TSDB: Fix PostingsForMatchers race with creating new series.

• Update to 2.45.1:

  • [ENHANCEMENT] Hetzner SD: Support larger ID's that will be used by Hetzner in September.
  • [BUGFIX] Linode SD: Cast InstanceSpec values to int64 to avoid overflows on 386 architecture.
  • [BUGFIX] TSDB: Handle TOC parsing failures.

• update to 2.45.0 (jsc#PED-5406):

  • [FEATURE] API: New limit parameter to limit the number of items returned by /api/v1/status/tsdb endpoint.
  • [FEATURE] Config: Add limits to global config.
  • [FEATURE] Consul SD: Added support for path_prefix.
  • [FEATURE] Native histograms: Add option to scrape both classic and native histograms.
  • [FEATURE] Native histograms: Added support for two more arithmetic operators avg_over_time and sum_over_time.
  • [FEATURE] Promtool: When providing the block id, only one block will be loaded and analyzed.
  • [FEATURE] Remote-write: New Azure ad configuration to support remote writing directly to Azure Monitor workspace.
  • [FEATURE] TSDB: Samples per chunk are now configurable with flag storage.tsdb.samples-per-chunk. By default set to its former value 120.
  • [ENHANCEMENT] Native histograms: bucket size can now be limited to avoid scrape fails.
  • [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL sooner.
  • [BUGFIX] Native histograms: ChunkSeries iterator now checks if a new sample can be appended to the open chunk.
  • [BUGFIX] Native histograms: Fix Histogram Appender Appendable() segfault.
  • [BUGFIX] Native histograms: Fix setting reset header to gauge histograms in seriesToChunkEncoder.
  • [BUGFIX] TSDB: Tombstone intervals are not modified after Get() call.
  • [BUGFIX] TSDB: Use path/filepath to set the WAL directory.

• update to 2.44.0:

  • [FEATURE] Remote-read: Handle native histograms.
  • [FEATURE] Promtool: Health and readiness check of prometheus server in CLI.
  • [FEATURE] PromQL: Add query_samples_total metric, the total number of samples loaded by all queries.
  • [ENHANCEMENT] Storage: Optimise buffer used to iterate through samples.
  • [ENHANCEMENT] Scrape: Reduce memory allocations on target labels.
  • [ENHANCEMENT] PromQL: Use faster heap method for topk() / bottomk().
  • [ENHANCEMENT] Rules API: Allow filtering by rule name.
  • [ENHANCEMENT] Native Histograms: Various fixes and improvements.
  • [ENHANCEMENT] UI: Search of scraping pools is now case-insensitive.
  • [ENHANCEMENT] TSDB: Add an affirmative log message for successful WAL repair.
  • [BUGFIX] TSDB: Block compaction failed when shutting down.
  • [BUGFIX] TSDB: Out-of-order chunks could be ignored if the write-behind log was deleted.

• rebase patch 0001-Do-not-force-the-pure-Go-name-resolver.patch onto v2.44.0

• update to 2.43.1

  • [BUGFIX] Labels: Set() after Del() would be ignored, which broke some relabeling rules.

• update to 2.43.0:

  • [FEATURE] Promtool: Add HTTP client configuration to query commands.
  • [FEATURE]…

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Allow a parallel docker-stable RPM to exists in repositories.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)

• Mark docker-buildx as required since classic 'docker build' has been deprecated since Docker 23.0. (bsc#1230331)

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. (bsc#1230333)

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070 bsc#1229806
  • CVE-2023-45142. bsc#1228553 bsc#1229806

• Update to Docker 26.1.4-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2614

• Update to Docker 26.1.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2610

• Update --add-runtime to point to correct binary path.

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Allow a parallel docker-stable RPM to exists in repositories.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Allow users to disable SUSE secrets support by setting DOCKER_SUSE_SECRETS_ENABLE=0 in /etc/sysconfig/docker. (bsc#1231348)

• Mark docker-buildx as required since classic 'docker build' has been deprecated since Docker 23.0. (bsc#1230331)

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. (bsc#1230333)

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070 bsc#1229806
  • CVE-2023-45142. bsc#1228553 bsc#1229806

• Update to Docker 26.1.4-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2614

• Update to Docker 26.1.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2610

• Update --add-runtime to point to correct binary path.

This update for containerd fixes the following issues:

• Update to containerd v1.7.21. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.21 Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553

• Update to containerd v1.7.17. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.17

• Update to containerd v1.7.16. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.16 CVE-2023-45288 bsc#1221400

• Update to containerd v1.7.15. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.15

• Update to containerd v1.7.14. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.14

• Update to containerd v1.7.13. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.13

• Update to containerd v1.7.12. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.12

• Update to containerd v1.7.11. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.11 GHSA-jq35-85cj-fj4p bsc#1224323

This update for docker fixes the following issues:

• Update docker-buildx to v0.19.2. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Add %{_sysconfdir}/audit/rules.d to filelist.

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294

• This update includes fixes for:

  • CVE-2024-41110. bsc#1228324
  • CVE-2023-47108. bsc#1217070
  • CVE-2023-45142. bsc#1228553

This update for docker fixes the following issues:

• This update includes fixes for:

  • CVE-2024-41110: Fixed Authz zero length regression (bsc#1228324)
  • CVE-2023-47108: Fixed otelgrpc: DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality (bsc#1217070 bsc#1229806)
  • CVE-2023-45142: Fixed otelhttp,otelhttptrace,otelrestful: DoS vulnerability (bsc#1228553 bsc#1229806)

• Update to Docker 27.5.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#2741 bsc#1237335

• Update to docker-buildx 0.20.1. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.20.1

• Update to Docker 27.4.1-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#2741

• Update to docker-buildx 0.19.3. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.19.3

• Update to Docker 27.4.0-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/27/#274

  https://github.com/docker/buildx/releases/tag/v0.19.2.

  Some notable changelogs from the last update:

  • https://github.com/docker/buildx/releases/tag/v0.19.0
  • https://github.com/docker/buildx/releases/tag/v0.18.0

• Update to Go 1.22.

• Add a new toggle file /etc/docker/suse-secrets-enable which allows users to disable the SUSEConnect integration with Docker (which creates special mounts in /run/secrets to allow container-suseconnect to authenticate containers with registries on registered hosts). bsc#1231348 bsc#1232999

  In order to disable these mounts, just do

  echo 0 > /etc/docker/suse-secrets-enable

  and restart Docker. In order to re-enable them, just do

  echo 1 > /etc/docker/suse-secrets-enable

  and restart Docker. Docker will output information on startup to tell you whether the SUSE secrets feature is enabled or not.

• Disable docker-buildx builds for SLES. It turns out that build containers with docker-buildx don't currently get the SUSE secrets mounts applied, meaning that container-suseconnect doesn't work when building images. bsc#1233819

• Remove DOCKER_NETWORK_OPTS from docker.service. This was removed from sysconfig a long time ago, and apparently this causes issues with systemd in some cases.

• Update to docker-buildx v0.17.1 to match standalone docker-buildx package we are replacing. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.17.1

• Mark docker-buildx as required since classic "docker build" has been deprecated since Docker 23.0. bsc#1230331

• Import docker-buildx v0.16.2 as a subpackage. Previously this was a separate package, but with docker-stable it will be necessary to maintain the packages together and it makes more sense to have them live in the same OBS package. bsc#1230333

• Update to Docker 26.1.5-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/26.1/#2615 bsc#1230294