CVE-2022-32149

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits.

Specific Go Packages Affected

golang.org/x/text/language

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.(CVE-2022-32149)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.(CVE-2022-32149)

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

These are all security issues fixed in the starboard-0.15.11-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-9.3.6-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-lusitaniae-apache_exporter-1.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the gitleaks-8.18.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Changes and bugs fixed:
  • Updated to 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Changes from 0.13.1
    • Fix panic caused by missing flagConfig options
  • Changes from 0.11.0 (jsc#SLE-24791)
    • Add TLS support
    • Switch to logger, please check --log.level and --log.format flags
  • Changes from 0.10.1
    • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
  • Changes from 0.10.0
    • Add Apache Proxy and other metrics
  • Changes from 0.8.0
    • Change commandline flags
    • Add metrics: Apache version, request duration total
  • Changes from 0.7.0
    • Handle OS TERM signals
  • Changes from 0.6.0
    • Add option to override host name
  • Added support for Red Hat Enterprise Linux
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Build using promu
  • Build with Go 1.19
  • Exclude s390 architecture

golang-github-prometheus-node_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

golang-github-QubitProducts-exporter_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

prometheus-postgres_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

scap-security-guide:

• Updated to 0.1.69 (jsc#ECO-3319)
  • Introduce a JSON build manifest
  • Introduce a script to compare ComplianceAsCode versions
  • Introduce CCN profiles for Red Hat Enterprise Linux 9
  • Map rules to components
  • products/anolis23: supports Anolis OS 23
  • Render components to HTML
  • Store rendered control files
  • Test and use rules to components mapping
  • Use distributed product properties
• Revert patch that breaks the SLE hardening (bsc#1213691)
• Changes from 0.1.68 (jsc#ECO-3319)
  • Bump OL8 STIG version to V1R6
  • Introduce a Product class, make the project work with it
  • Introduce Fedora and Firefox CaC profiles for common workstation users
  • OL7 DISA STIG v2r11 update
  • Publish rendered policy artifacts
  • Update ANSSI BP-028 to version 2.0
• Changes from 0.1.67 (jsc#ECO-3319)
  • Add utils/controlrefcheck.py
  • Red Hat Enterprise Linux 9 STIG Update Q1 2023
  • Include warning for NetworkManager keyfiles in Red Hat Enterprise Linux 9
  • OL7 stig v2r10 update
  • Bump version of OL8 STIG to V1R5
• Various enhancements to SLE profiles

spacecmd:

• Updated to 4.3.23-1
  • Update translation strings

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

bind:

• Provide bind dependencies and solve installation issues on SUSE Linux Enterprise Micro
• There are no source changes

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from…

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Changes and bugs fixed:
  • Updated to 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Changes from 0.13.1
    • Fix panic caused by missing flagConfig options
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Build using promu
  • Build with Go 1.19
  • Exclude s390 architecture

golang-github-prometheus-alertmanager:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

golang-github-prometheus-node_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

golang-github-prometheus-prometheus:

• This update introduces breaking changes. Please, read carefully the provided informations.
• Security issues fixed:
  • CVE-2022-41723: Fix uncontrolled resource consumption by updating Go to version 1.20.1 (bsc#1208298)
• Updated to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API: New limit parameter to limit the number of items returned by /api/v1/status/tsdb endpoint
  • [FEATURE] Config: Add limits to global config
  • [FEATURE] Consul SD: Added support for path_prefix
  • [FEATURE] Native histograms: Add option to scrape both classic and native histograms.
  • [FEATURE] Native histograms: Added support for two more arithmetic operators avg_over_time and sum_over_time
  • [FEATURE] Promtool: When providing the block id, only one block will be loaded and analyzed
  • [FEATURE] Remote-write: New Azure ad configuration to support remote writing directly to Azure Monitor workspace
  • [FEATURE] TSDB: Samples per chunk are now configurable with flag storage.tsdb.samples-per-chunk. By default set to its former value 120
  • [ENHANCEMENT] Native histograms: bucket size can now be limited to avoid scrape fails
  • [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL sooner
  • [BUGFIX] Native histograms: ChunkSeries iterator now checks if a new sample can be appended to the open chunk
  • [BUGFIX] Native histograms: Fix Histogram Appender Appendable() segfault
  • [BUGFIX] Native histograms: Fix setting reset header to gauge histograms in seriesToChunkEncoder
  • [BUGFIX] TSDB: Tombstone intervals are not modified after Get() call
  • [BUGFIX] TSDB: Use path/filepath to set the WAL directory.
• Changes from 2.44.0:
  • [FEATURE] Remote-read: Handle native histograms
  • [FEATURE] Promtool: Health and readiness check of prometheus server in CLI
  • [FEATURE] PromQL: Add query_samples_total metric, the total number of samples loaded by all queries
  • [ENHANCEMENT] Storage: Optimise buffer used to iterate through samples
  • [ENHANCEMENT] Scrape: Reduce memory allocations on target labels
  • [ENHANCEMENT] PromQL: Use faster heap method for topk() / bottomk()
  • [ENHANCEMENT] Rules API: Allow filtering by rule name
  • [ENHANCEMENT] Native Histograms: Various fixes and improvements
  • [ENHANCEMENT] UI: Search of scraping pools is now case-insensitive
  • [ENHANCEMENT] TSDB: Add an affirmative log message for successful WAL repair
  • [BUGFIX] TSDB: Block compaction failed when shutting down
  • [BUGFIX] TSDB: Out-of-order chunks could be ignored if the write-behind log was deleted
• Changes from 2.43.1
  • [BUGFIX] Labels:…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Changes and bugs fixed:
  • Updated to 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Changes from 0.13.1
    • Fix panic caused by missing flagConfig options
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Build using promu
  • Build with Go 1.19
  • Exclude s390 architecture

golang-github-prometheus-prometheus:

• This update introduces breaking changes. Please, read carefully the provided informations.
• Security issues fixed:
  • CVE-2022-41723: Fix uncontrolled resource consumption by updating Go to version 1.20.1 (bsc#1208298)
• Updated to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API: New limit parameter to limit the number of items returned by /api/v1/status/tsdb endpoint
  • [FEATURE] Config: Add limits to global config
  • [FEATURE] Consul SD: Added support for path_prefix
  • [FEATURE] Native histograms: Add option to scrape both classic and native histograms.
  • [FEATURE] Native histograms: Added support for two more arithmetic operators avg_over_time and sum_over_time
  • [FEATURE] Promtool: When providing the block id, only one block will be loaded and analyzed
  • [FEATURE] Remote-write: New Azure ad configuration to support remote writing directly to Azure Monitor workspace
  • [FEATURE] TSDB: Samples per chunk are now configurable with flag storage.tsdb.samples-per-chunk. By default set to its former value 120
  • [ENHANCEMENT] Native histograms: bucket size can now be limited to avoid scrape fails
  • [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL sooner
  • [BUGFIX] Native histograms: ChunkSeries iterator now checks if a new sample can be appended to the open chunk
  • [BUGFIX] Native histograms: Fix Histogram Appender Appendable() segfault
  • [BUGFIX] Native histograms: Fix setting reset header to gauge histograms in seriesToChunkEncoder
  • [BUGFIX] TSDB: Tombstone intervals are not modified after Get() call
  • [BUGFIX] TSDB: Use path/filepath to set the WAL directory.
• Changes from 2.44.0:
  • [FEATURE] Remote-read: Handle native histograms
  • [FEATURE] Promtool: Health and readiness check of prometheus server in CLI
  • [FEATURE] PromQL: Add query_samples_total metric, the total number of samples loaded by all queries
  • [ENHANCEMENT] Storage: Optimise buffer used to iterate through samples
  • [ENHANCEMENT] Scrape: Reduce memory allocations on target labels
  • [ENHANCEMENT] PromQL: Use faster heap method for topk() / bottomk()
  • [ENHANCEMENT] Rules API: Allow filtering by rule name
  • [ENHANCEMENT] Native Histograms: Various fixes and improvements
  • [ENHANCEMENT] UI: Search of scraping pools is now case-insensitive
  • [ENHANCEMENT] TSDB: Add an affirmative log message for successful WAL repair
  • [BUGFIX] TSDB: Block compaction failed when shutting down
  • [BUGFIX] TSDB: Out-of-order chunks could be ignored if the write-behind log was deleted
• Changes from 2.43.1
  • [BUGFIX] Labels: Set() after Del() would be ignored, which broke some relabeling rules
• Changes from 2.43.0:
  • [FEATURE] Promtool: Add HTTP client configuration to query commands
  • [FEATURE] Scrape: Add include_scrape_configs to include scrape configs from different files
  • [FEATURE] HTTP client: Add no_proxy to exclude URLs from proxied requests
  • [FEATURE] HTTP client: Add proxy_from_enviroment to read proxies from env variables
  • [ENHANCEMENT] API: Add support for setting lookback delta per query via the API
  • [ENHANCEMENT] API: Change HTTP status code from 503/422 to 499 if a request is canceled
  • [ENHANCEMENT] Scrape: Allow exemplars for all metric types *…