CVE-2021-29622

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Impact

In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint.

If a user visits a prometheus server with a specially crafted address (e.g.: http://127.0.0.1:9090/new/new<url>), they can be redirected to an arbitrary URL.

e.g. if a user visits http://127.0.0.1:9090/new/newhttp://www.google.com/, they will be redirected to http://google.com.

Patches

The issue will be patched in 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely.

Workarounds

The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Note: Users who use a --web.external-url= flag with a path (e.g. --web.external-url=http://example.com/prometheus) are not affected.

For more information

If you have any questions or comments about this advisory, please use our community channels (https://prometheus.io/community). Our security policy is available at https://prometheus.io/docs/operating/security/

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.

This update fixes the following issues:

ansible:

• The support level for ansible is l2, not l3

dracut-saltboot:

• Force installation of libexpat.so.1 (bsc#1188846)
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE Linux Enterprise 15, 15 SP1, 15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  • TSDB: Do not panic when writing very large records to the WAL. #8790
  • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  • Scaleway Discovery: Fix nil pointer dereference. #8737
  • Consul Discovery: Restart no longer required after config update with no targets. #8766
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
• Update package with changes from server:monitoring (bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1's firewalld package does not contain 'prometheus' configuration yet.

mgr-cfg:

• No visible impact for the user

mgr-custom-info:

• No visible impact for the user

mgr-osad:

• No visible impact for the user

mgr-push:

• No visible impact for the user

mgr-virtualization:

• No visible impact for the user

rhnlib:

• No visible impact for the user

spacecmd:

• Make spacecmd aware of retracted patches/packages
• Enhance help for installation types when creating distributions (bsc#1186581)
• Parse empty argument when nothing in between the separator

spacewalk-client-tools:

• Update translation strings

spacewalk-koan:

• Fix for spacewalk-koan tests after switching to the new Docker images

spacewalk-oscap:

• No visible impact for the user

suseRegisterInfo:

• No visible impact for the user

uyuni-common-libs:

• Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650)
• Maintainer field in debian packages are only recommended (bsc#1186508)

This update was imported from the SUSE:SLE-15:Update update project.

This update for golang-github-prometheus-prometheus fixes the following issues:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SLE15, SLE15 SP1, SLE15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • Features:
    • Promtool: Retroactive rule evaluation functionality. #7675
    • Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
    • TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme. #8604
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
    • Docker Discovery: Add Docker Service Discovery. #8629
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
    • Scaleway Discovery: Read Scaleway secret from a file. #8643
    • Scrape: Add configurable limits for label size and count. #8777
    • UI: Add 16w and 26w time range steps. #8656
    • Templating: Enable parsing strings in humanize functions. #8682
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
    • TSDB: Do not panic when writing very large records to the WAL. #8790
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
    • Scaleway Discovery: Fix nil pointer dereference. #8737
    • Consul Discovery: Restart no longer required after config update with no targets. #8766
• Add tarball with vendor modules and web assets
• Uyuni: Read formula data from exporters map
• Uyuni: Add support for TLS targets
• Upgrade to upstream version 2.26.0
  • Changes
    • Alerting: Using Alertmanager v2 API by default. #8626
    • Prometheus/Promtool: Binaries are now printing help and usage to stdout instead of stderr. #8542
  • Features
    • Remote: Add support for AWS SigV4 auth method for remote_write. #8509
    • PromQL: Allow negative offsets. Behind --enable-feature=promql-negative-offset flag. #8487
    • UI: Add advanced auto-completion, syntax highlighting and linting to graph page query input. #8634
  • Enhancements
    • PromQL: Add last_over_time, sgn, clamp functions. #8457
    • Scrape: Add support for specifying type of Authorization header credentials with Bearer by default. #8512
    • Scrape: Add follow_redirects option to scrape configuration. #8546
    • Remote: Allow retries on HTTP 429 response code for remote_write. #8237 #8477
    • Remote: Allow configuring custom headers for remote_read. #8516
    • UI: Hitting Enter now triggers new query. #8581
    • UI: Better handling of long rule and names on the /rules and /targets pages. #8608 #8609
    • UI: Add collapse/expand all button on the /targets page. #8486
• Upgrade to upstream version 2.25.0
  • Features
    • Include a new --enable-feature= flag that enables experimental features.
  • Enhancements
    • Add optional name property to testgroup for better test failure output. #8440
    • Add warnings into React Panel on the Graph page. #8427
    • TSDB: Increase the number of buckets for the compaction duration metric. #8342
    • Remote: Allow passing along custom remote_write HTTP headers. #8416
    • Mixins: Scope grafana configuration. #8332
    • Kubernetes SD: Add endpoint labels metadata. #8273
    • UI: Expose total number of label pairs in head in TSDB stats page. #8343
    • TSDB: Reload blocks every minute, to detect new blocks and enforce retention more often. #8343
  • Bug fixes
    • API: Fix global URL when external address has no port. #8359
    • Deprecate unused flag --alertmanager.timeout. #8407
• Upgrade to upstream…

This update fixes the following issues:

ansible:

• The support level for ansible is l2, not l3

dracut-saltboot:

• Force installation of libexpat.so.1 (bsc#1188846)
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE Linux Enterprise 15, 15 SP1, 15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  • TSDB: Do not panic when writing very large records to the WAL. #8790
  • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  • Scaleway Discovery: Fix nil pointer dereference. #8737
  • Consul Discovery: Restart no longer required after config update with no targets. #8766
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
• Update package with changes from server:monitoring (bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1's firewalld package does not contain 'prometheus' configuration yet.

mgr-cfg:

• No visible impact for the user

mgr-custom-info:

• No visible impact for the user

mgr-osad:

• No visible impact for the user

mgr-push:

• No visible impact for the user

mgr-virtualization:

• No visible impact for the user

rhnlib:

• No visible impact for the user

spacecmd:

• Make spacecmd aware of retracted patches/packages
• Enhance help for installation types when creating distributions (bsc#1186581)
• Parse empty argument when nothing in between the separator

spacewalk-client-tools:

• Update translation strings

spacewalk-koan:

• Fix for spacewalk-koan tests after switching to the new Docker images

spacewalk-oscap:

• No visible impact for the user

suseRegisterInfo:

• No visible impact for the user

uyuni-common-libs:

• Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650)
• Maintainer field in debian packages are only recommended (bsc#1186508)

These are all security issues fixed in the golang-github-prometheus-prometheus-2.27.1-4.2 package on the GA media of openSUSE Tumbleweed.

This update for golang-github-prometheus-prometheus fixes the following issues:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SLE15, SLE15 SP1, SLE15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • Features:
    • Promtool: Retroactive rule evaluation functionality. #7675
    • Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
    • TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme. #8604
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
    • Docker Discovery: Add Docker Service Discovery. #8629
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
    • Scaleway Discovery: Read Scaleway secret from a file. #8643
    • Scrape: Add configurable limits for label size and count. #8777
    • UI: Add 16w and 26w time range steps. #8656
    • Templating: Enable parsing strings in humanize functions. #8682
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
    • TSDB: Do not panic when writing very large records to the WAL. #8790
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
    • Scaleway Discovery: Fix nil pointer dereference. #8737
    • Consul Discovery: Restart no longer required after config update with no targets. #8766
• Add tarball with vendor modules and web assets
• Uyuni: Read formula data from exporters map
• Uyuni: Add support for TLS targets
• Upgrade to upstream version 2.26.0
  • Changes
    • Alerting: Using Alertmanager v2 API by default. #8626
    • Prometheus/Promtool: Binaries are now printing help and usage to stdout instead of stderr. #8542
  • Features
    • Remote: Add support for AWS SigV4 auth method for remote_write. #8509
    • PromQL: Allow negative offsets. Behind --enable-feature=promql-negative-offset flag. #8487
    • UI: Add advanced auto-completion, syntax highlighting and linting to graph page query input. #8634
  • Enhancements
    • PromQL: Add last_over_time, sgn, clamp functions. #8457
    • Scrape: Add support for specifying type of Authorization header credentials with Bearer by default. #8512
    • Scrape: Add follow_redirects option to scrape configuration. #8546
    • Remote: Allow retries on HTTP 429 response code for remote_write. #8237 #8477
    • Remote: Allow configuring custom headers for remote_read. #8516
    • UI: Hitting Enter now triggers new query. #8581
    • UI: Better handling of long rule and names on the /rules and /targets pages. #8608 #8609
    • UI: Add collapse/expand all button on the /targets page. #8486
• Upgrade to upstream version 2.25.0
  • Features
    • Include a new --enable-feature= flag that enables experimental features.
  • Enhancements
    • Add optional name property to testgroup for better test failure output. #8440
    • Add warnings into React Panel on the Graph page. #8427
    • TSDB: Increase the number of buckets for the compaction duration metric. #8342
    • Remote: Allow passing along custom remote_write HTTP headers. #8416
    • Mixins: Scope grafana configuration. #8332
    • Kubernetes SD: Add endpoint labels metadata. #8273
    • UI: Expose total number of label pairs in head in TSDB stats page. #8343
    • TSDB: Reload blocks every minute, to detect new blocks and enforce retention more often. #8343
  • Bug fixes
    • API: Fix global URL when external address has no port. #8359
    • Deprecate unused flag --alertmanager.timeout. #8407
• Upgrade to upstream…

This update fixes the following issues:

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:

  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SUSE Linux Enterprise 15, SP1, SP2

• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)

  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • TSDB: Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page.
    • TSDB: Do not panic when writing very large records to the WAL.
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed.
    • Scaleway Discovery: Fix nil pointer dereference.
    • Consul Discovery: Restart no longer required after config update with no targets.

• Update package with changes from server:monitoring (bsc#1175478) Left out removal of firewalld related configuration files as SLE-15-SP1's firewalld package does not contain prometheus configuration yet.

grafana:

• Update to version 7.5.7:
  • Updated relref to 'Configuring exemplars' section
  • Added exemplar topic
  • Quota: Do not count folders towards dashboard quota
  • Instructions to separate emails with semicolons
  • Docs: Remove documentation of v8 generic OAuth feature
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned
  • Add missing '--no-cache' to Dockerfile.
  • ReleaseNotes: Updated changelog and release notes for 7.5.6
  • Stop hoisting @icons/material
  • Chore: fix react-color version in yarn.lock.
  • 'Release: Updated versions in package to 7.5.6'
  • Loki: fix label browser crashing when + typed
  • Document hide_version flag
  • Add isolation level db configuration parameter
  • Sanitize PromLink button
  • Docs feedback: '/administration/provisioning.md'
  • Docs: delete from high availability docs references to removed configurations related to session storage
  • Docs: Update '_index.md'
  • Docs: Update 'installation.md'
  • GraphNG: uPlot 1.6.9
  • dont consider invalid email address a failed email
  • InfluxDB: Improve measurement-autocomplete behavior in query editor
  • add template for dashboard url parameters
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model
  • Update 'team.md'
  • Removed duplicate file 'dashboard_folder_permissions.md'
  • Document 'customQueryParameters' for prometheus datasource provisioning
  • ReleaseNotes: Updated changelog and release notes for 7.5.5
  • Documentation: Update 'developer-guide.md'
  • add closed parenthesis to fix a hyperlink
  • GraphNG: Fix exemplars window position
  • Remove field limitation from slack notification
  • Prometheus: Support POST in template variables
  • Instrumentation: Add success rate metrics for email notifications
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time)
  • Docs: Removed type from find annotations example.
  • FrontendMetrics: Adds new backend api that…

This update fixes the following issues:

ansible:

• The support level for ansible is l2, not l3

dracut-saltboot:

• Force installation of libexpat.so.1 (bsc#1188846)
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE Linux Enterprise 15, 15 SP1, 15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  • TSDB: Do not panic when writing very large records to the WAL. #8790
  • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  • Scaleway Discovery: Fix nil pointer dereference. #8737
  • Consul Discovery: Restart no longer required after config update with no targets. #8766
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
• Update package with changes from server:monitoring (bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1's firewalld package does not contain 'prometheus' configuration yet.

mgr-cfg:

• No visible impact for the user

mgr-custom-info:

• No visible impact for the user

mgr-osad:

• No visible impact for the user

mgr-push:

• No visible impact for the user

mgr-virtualization:

• No visible impact for the user

rhnlib:

• No visible impact for the user

spacecmd:

• Make spacecmd aware of retracted patches/packages
• Enhance help for installation types when creating distributions (bsc#1186581)
• Parse empty argument when nothing in between the separator

spacewalk-client-tools:

• Update translation strings

spacewalk-koan:

• Fix for spacewalk-koan tests after switching to the new Docker images

spacewalk-oscap:

• No visible impact for the user

suseRegisterInfo:

• No visible impact for the user

uyuni-common-libs:

• Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650)
• Maintainer field in debian packages are only recommended (bsc#1186508)

This update fixes the following issues:

cobbler:

• Fixed rce in the xmlrpc which additionally allowed arbirtrary file read and write as root (bsc#1189458)

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SLE15, SLE15 SP1, SLE15 SP2
• Refresh patches
  • Changed:
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
• Upgrade to upstream version 2.27.0
  • Features:
    • Promtool: Retroactive rule evaluation functionality. #7675
    • Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
    • TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
    • UI: Add a dark theme. #8604
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
    • Docker Discovery: Add Docker Service Discovery. #8629
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
    • Scaleway Discovery: Read Scaleway secret from a file. #8643
    • Scrape: Add configurable limits for label size and count. #8777
    • UI: Add 16w and 26w time range steps. #8656
    • Templating: Enable parsing strings in humanize functions. #8682
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
    • TSDB: Do not panic when writing very large records to the WAL. #8790
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
    • Scaleway Discovery: Fix nil pointer dereference. #8737
    • Consul Discovery: Restart no longer required after config update with no targets. #8766
• Update package with changes from server:monitoring bsc#1175478 Left out removal of firewalld related configuration files as SLE-15-SP1's firewalld package does not contain prometheus configuration yet.

grafana:

• Add URL to package source code in the login page footer
• Update to version 7.5.7:
  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note…

This update fixes the following issues:

dracut-saltboot:

• Fix dependencies of python libs (bsc#1188846)
• Update to version 0.1.1628156312.dbd0dec
• Force installation of libexpat.so.1 (bsc#1188846)
• Update to version 0.1.1627546504.96a0b3e
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SLE15, SLE15 SP1, SLE15 SP2
• Refresh patches
  • Changed:
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
• Upgrade to upstream version 2.27.0
  • Features:
    • Promtool: Retroactive rule evaluation functionality. #7675
    • Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
    • TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
    • UI: Add a dark theme. #8604
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
    • Docker Discovery: Add Docker Service Discovery. #8629
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
    • Scaleway Discovery: Read Scaleway secret from a file. #8643
    • Scrape: Add configurable limits for label size and count. #8777
    • UI: Add 16w and 26w time range steps. #8656
    • Templating: Enable parsing strings in humanize functions. #8682
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
    • TSDB: Do not panic when writing very large records to the WAL. #8790
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
    • Scaleway Discovery: Fix nil pointer dereference. #8737
    • Consul Discovery: Restart no longer required after config update with no targets. #8766
• Update package with changes from server:monitoring bsc#1175478 Left out removal of firewalld related configuration files as SLE-15-SP1's firewalld package does not contain prometheus configuration yet.

grafana:

• Add URL to package source code in the login page footer
• Update to version 7.5.7:
  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB:…