CVE-2019-10136

This update fixes the following issues:

spacewalk-backend:

• Do not duplicate 'http://' protocol when using proxies with 'deb' repositories (bsc#1138313)
• Fix reposync when dealing with RedHat CDN (bsc#1138358)
• Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480)

spacewalk-web:

• Change WebUI version 4.0.1

susemanager-doc-indexes:

• Updated wording for prometheus section
• Jeos VM update
• Port 8050 for graphical console display
• Content life-cycle docs are not enough for customer to understand (bsc#1137955)
• Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
• Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561)

susemanager-docs_en:

• Updated wording for prometheus section
• Jeos VM update
• Port 8050 for graphical console display
• Content life-cycle docs are not enough for customer to understand (bsc#1137955)
• Salt boot formula fails for SLES11 SP3 terminal (bsc#1136857)
• Certificate verify failed when using vmware esxi virtual host gatherer (bsc#1136561)

susemanager-sync-data:

• Add channel family definitions for SLES12 SP3 LTSS (bsc#1139693)
• Add OPENSUSE to allowed channel_families to make openSUSE Leap product visible in the product list (bsc#1138364)

This update fixes the following issues:

release-notes-susemanager:

• Fix invalid characters in ncurses mode (bsc#1102770)

spacewalk-backend:

• Fix for CVE-2019-10136. An attacker with a valid, but expired, authenticated set of headers could move some digits around, artificially extending the session validity without modifying the checksum. (bsc#1136480)

spacewalk-web:

• Change WebUI string version to 3.2.9

This update fixes the following issues:

golang-github-prometheus-prometheus:

• Add support for Uyuni/SUSE Manager service discovery
  • Added 0003-Add-Uyuni-service-discovery
• Readded _service file removed in error.
• Update to 2.11.1
  • Bug Fix:
    • Fix potential panic when prometheus is watching multiple zookeeper paths.
• Update to 2.11.0
  • Bug Fix:
    • resolve race condition in maxGauge.
    • Fix ZooKeeper connection leak.
    • Improved atomicity of .tmp block replacement during compaction for usual case.
    • Fix 'unknown series references' after clean shutdown.
    • Re-calculate block size when calling block.Delete.
    • Fix unsafe snapshots with head block.
    • prometheus_tsdb_compactions_failed_total is now incremented on any compaction failure.
  • Changes:
    • Remove max_retries from queue_config (it has been unused since rewriting remote-write to utilize the write-ahead-log)
    • The meta file BlockStats no longer holds size information. This is now dynamically calculated and kept in memory. It also includes the meta file size which was not included before
    • Renamed metric from prometheus_tsdb_wal_reader_corruption_errors to prometheus_tsdb_wal_reader_corruption_errors_total
  • Features:
    • Add option to use Alertmanager API v2.
    • Added humanizePercentage function for templates.
    • Include InitContainers in Kubernetes Service Discovery.
    • Provide option to compress WAL records using Snappy.
  • Enhancements:
    • Create new clean segment when starting the WAL.
    • Reduce allocations in PromQL aggregations.
    • Add storage warnings to LabelValues and LabelNames API results.
    • Add prometheus_http_requests_total metric.
    • Enable openbsd/arm build.
    • Remote-write allocation improvements.
    • Query performance improvement: Efficient iteration and search in HashForLabels and HashWithoutLabels.
    • Allow injection of arbitrary headers in promtool.
    • Allow passing external_labels in alert unit tests groups.
    • Allows globs for rules when unit testing.
    • Improved postings intersection matching.
    • Reduced disk usage for WAL for small setups.
    • Optimize queries using regexp for set lookups.
• Rebase patch002-Default-settings.patch
• Update to 2.10.0:
  • Bug Fixes:
    • TSDB: Don't panic when running out of disk space and recover nicely from the condition
    • TSDB: Correctly handle empty labels.
    • TSDB: Don't crash on an unknown tombstone reference.
    • Storage/remote: Remove queue-manager specific metrics if queue no longer exists.
    • PromQL: Correctly display {name='a'}.
    • Discovery/kubernetes: Use service rather than ingress as the name for the service workqueue.
    • Discovery/azure: Don't panic on a VM with a public IP.
    • Web: Fixed Content-Type for js and css instead of using /etc/mime.types.
    • API: Encode alert values as string to correctly represent Inf/NaN.
  • Features:
    • Template expansion: Make external labels available as $externalLabels in alert and console template expansion.
    • TSDB: Add prometheus_tsdb_wal_segment_current metric for the WAL segment index that TSDB is currently writing to. tsdb
    • Scrape: Add scrape_series_added per-scrape metric. #5546
  • Enhancements
    • Discovery/kubernetes: Add labels __meta_kubernetes_endpoint_node_name and __meta_kubernetes_endpoint_hostname.
    • Discovery/azure: Add label __meta_azure_machine_public_ip.
    • TSDB: Simplify mergedPostings.Seek, resulting in better performance if there are many posting lists. tsdb
    • Log filesystem type on startup.
    • Cmd/promtool: Use POST requests for Query and QueryRange. client_golang
    • Web: Sort alerts by group name.
    • Console templates: Add convenience variables $rawParams, $params, $path.
• Upadte to 2.9.2
  • Bug Fixes:
    • Make sure subquery range is taken into account for selection
    • Exhaust every request body before closing it
    • Cmd/promtool:…

This update fixes the following issues:

golang-github-prometheus-prometheus:

• Add support for Uyuni/SUSE Manager service discovery
  • Added 0003-Add-Uyuni-service-discovery
• Readded _service file removed in error.
• Update to 2.11.1
  • Bug Fix:
    • Fix potential panic when prometheus is watching multiple zookeeper paths.
• Update to 2.11.0
  • Bug Fix:
    • resolve race condition in maxGauge.
    • Fix ZooKeeper connection leak.
    • Improved atomicity of .tmp block replacement during compaction for usual case.
    • Fix 'unknown series references' after clean shutdown.
    • Re-calculate block size when calling block.Delete.
    • Fix unsafe snapshots with head block.
    • prometheus_tsdb_compactions_failed_total is now incremented on any compaction failure.
  • Changes:
    • Remove max_retries from queue_config (it has been unused since rewriting remote-write to utilize the write-ahead-log)
    • The meta file BlockStats no longer holds size information. This is now dynamically calculated and kept in memory. It also includes the meta file size which was not included before
    • Renamed metric from prometheus_tsdb_wal_reader_corruption_errors to prometheus_tsdb_wal_reader_corruption_errors_total
  • Features:
    • Add option to use Alertmanager API v2.
    • Added humanizePercentage function for templates.
    • Include InitContainers in Kubernetes Service Discovery.
    • Provide option to compress WAL records using Snappy.
  • Enhancements:
    • Create new clean segment when starting the WAL.
    • Reduce allocations in PromQL aggregations.
    • Add storage warnings to LabelValues and LabelNames API results.
    • Add prometheus_http_requests_total metric.
    • Enable openbsd/arm build.
    • Remote-write allocation improvements.
    • Query performance improvement: Efficient iteration and search in HashForLabels and HashWithoutLabels.
    • Allow injection of arbitrary headers in promtool.
    • Allow passing external_labels in alert unit tests groups.
    • Allows globs for rules when unit testing.
    • Improved postings intersection matching.
    • Reduced disk usage for WAL for small setups.
    • Optimize queries using regexp for set lookups.
• Rebase patch002-Default-settings.patch
• Update to 2.10.0:
  • Bug Fixes:
    • TSDB: Don't panic when running out of disk space and recover nicely from the condition
    • TSDB: Correctly handle empty labels.
    • TSDB: Don't crash on an unknown tombstone reference.
    • Storage/remote: Remove queue-manager specific metrics if queue no longer exists.
    • PromQL: Correctly display {name='a'}.
    • Discovery/kubernetes: Use service rather than ingress as the name for the service workqueue.
    • Discovery/azure: Don't panic on a VM with a public IP.
    • Web: Fixed Content-Type for js and css instead of using /etc/mime.types.
    • API: Encode alert values as string to correctly represent Inf/NaN.
  • Features:
    • Template expansion: Make external labels available as $externalLabels in alert and console template expansion.
    • TSDB: Add prometheus_tsdb_wal_segment_current metric for the WAL segment index that TSDB is currently writing to. tsdb
    • Scrape: Add scrape_series_added per-scrape metric. #5546
  • Enhancements
    • Discovery/kubernetes: Add labels __meta_kubernetes_endpoint_node_name and __meta_kubernetes_endpoint_hostname.
    • Discovery/azure: Add label __meta_azure_machine_public_ip.
    • TSDB: Simplify mergedPostings.Seek, resulting in better performance if there are many posting lists. tsdb
    • Log filesystem type on startup.
    • Cmd/promtool: Use POST requests for Query and QueryRange. client_golang
    • Web: Sort alerts by group name.
    • Console templates: Add convenience variables $rawParams, $params, $path.
• Upadte to 2.9.2
  • Bug Fixes:
    • Make sure subquery range is taken into account for selection
    • Exhaust every request body before closing it
    • Cmd/promtool:…