CVE-2021-43813

Security Fix(es):

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/./markdown/. without losing any functionality beyond inlined plugin help text.(CVE-2021-43813)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.11). (BZ#1993214)

Security Fix(es):

• grafana: directory traversal vulnerability (CVE-2021-43813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/./markdown/. without losing any functionality beyond inlined plugin help text.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.11). (BZ#1993214)

Security Fix(es):

• grafana: directory traversal vulnerability (CVE-2021-43813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/./markdown/. without losing any functionality beyond inlined plugin help text.

This update for grafana fixes the following issues:

• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454)
• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688)

These are all security issues fixed in the grafana-7.5.12-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23422)

• Security:

  • CVE-2022-21702: XSS vulnerability in handling data sources (bsc#1195726)
  • CVE-2022-21703: cross-origin request forgery vulnerability (bsc#1195727)
  • CVE-2022-21713: Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728)
  • CVE-2022-21673: GetUserInfo: return an error if no user was found (bsc#1194873)
  • CVE-2021-43813, CVE-2021-43815, CVE-2021-41244, CVE-2021-41174, CVE-2021-43798, CVE-2021-39226.
  • Upgrade Docker base image to Alpine 3.14.3.
  • CVE-2021-3711: Docker: Force use of libcrypto1.1 and libssl1.1 versions
  • Update dependencies to fix CVE-2021-36222.
  • Upgrade Go to 1.17.2.
  • Fix stylesheet injection vulnerability.
  • Fix short URL vulnerability.

• License update:

  • AGPL License: Update license from Apache 2.0 to the GNU Affero General Public License (AGPL).

• Breaking changes:

  • Grafana 8 Alerting enabled by default for installations that do not use legacy alerting.
  • Keep Last State for 'If execution error or timeout' when upgrading to Grafana 8 alerting.
  • Fix No Data behaviour in Legacy Alerting.
  • The following endpoints were deprecated for Grafana v5.0 and support for them has now been removed:
    • GET /dashboards/db/:slug
    • GET /dashboard-solo/db/:slug
    • GET /api/dashboard/db/:slug
    • DELETE /api/dashboards/db/:slug
  • The default HTTP method for Prometheus data source is now POST.
  • Removes the never refresh option for Query variables.
  • Removes the experimental Tags feature for Variables.

• Deprecations:

  • The InfoBox & FeatureInfoBox are now deprecated please use the Alert component instead with severity info.

• Bug fixes:

  • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
  • Azure Monitor: Improved error messages for variable queries.
  • CloudMonitoring: Fixes broken variable queries that use group bys.
  • Configuration: You can now see your expired API keys if you have no active ones.
  • Elasticsearch: Fix handling multiple datalinks for a single field.
  • Export: Fix error when exporting dashboards using query variables that reference the default datasource.
  • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
  • Login: Page no longer overflows on mobile.
  • Plugins: Set backend metadata property for core plugins.
  • Prometheus: Fill missing steps with null values.
  • Prometheus: Fix interpolation of $__rate_interval variable.
  • Prometheus: Interpolate variables with curly brackets syntax.
  • Prometheus: Respect the http-method data source setting.
  • Table: Fixes issue with field config applied to wrong fields when hiding columns.
  • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
  • Variables: Fix so data source variables are added to adhoc configuration.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix…

This update for grafana fixes the following issues:

• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454)
• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688)

This update for grafana fixes the following issues:

• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454)
• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688)

This update fixes the following issues:

grafana:

• Update to version 7.5.12:
  • Fix markdown path traversal (#42969, bsc#1193688, CVE-2021-43813)
• Recreate tarballs using the makefile to update the npm and go modules required
• Update to version 7.5.11:
  • Fix Snapshot authentication bypass (bsc#1191454, CVE-2021-39226)
  • Fix certs issue (#40002)
  • Release v7.5.11 (#124)
  • Fix static path matching issue in macaron
  • OAuth: add docs for disableAutoLogin param (#38752) (#38894)
  • Fix #747; remove 'other variables'. (#37866) (#37878)
  • Update alert docs (#33658) (#33659)
  • [7.5.x] Docs: added documentation for the 'prepare time series'-transformation. (#36836)
  • cherry picked dc5778c303ca555b70e8ca8c28e95997e26ecfc1 (#36813)
  • 'Release: Updated versions in package to 7.5.10' (#36792)
  • [v7.5.x] Transformations: add 'prepare time series' transformer (#36749)
  • Remove verify-drone from windows (#36775)
  • Update queries.md (#31941) (#36764)
  • Updated content to specify method to use to get keyboard shortcuts; (#36084) (#36087)
  • ReleaseNotes: Updated changelog and release notes for 7.5.9 (#36057) (#36077)
  • 'Release: Updated versions in package to 7.5.9' (#36056)
  • Login: Fixes Unauthorized message showing when on login page or snapshot page (#35311) (#35880)
  • ReleaseNotes: Updated changelog and release notes for 7.5.8 (#35703) (#35822)
  • CI: Upgrade pipeline tool to use main (#35804)
  • CI: try to force v7.5.x instead of master (#35799)
  • CI: supports move from master to main in 7.5.x release branch (#35747)
  • 'Release: Updated versions in package to 7.5.8' (#35701)
  • Chore: Bump acorn and lodash-es (#35650)
  • Snapshots: Remove dashboard links from snapshots (#35567) (#35585)
  • [v7.5.x] Datasource: Allow configuring MaxConnsPerHost (#35519)
  • Remove docs sync from v7.5.x (#35443)
  • 'Release: Updated versions in package to 7.5.7' (#35412)
  • Add max_idle_connections_per_host to config (#35365)
  • Update go.sum to fix failing enterprise pipeline (#35353)
  • [v7.5.x] HTTP Client: Introduce go-conntrack (#35321)
  • Fix Markdown syntax in enterprise/license/_index.md (#34683) (#35210)
  • Update annotations.md (#33218) (#35138)
  • Docs: Add query caching to enterprise docs page (#34751) (#35025)
  • [7.5.x] Admin: hide per role counts for licensed users (#34994)
  • cleanup shortcodes, image paths (#34827)
  • Security: Upgrade Thrift dependency (#34698) (#34702)
  • Docs: Fix Quick Start link on Geting Started Influx page (#34549) (#34603)
  • Add link to release notes v7.5.7 (#34460) (#34474)
  • Update 7.5.x landing page (#34447)
  • ReleaseNotes: Updated changelog and release notes for 7.5.7 (#34383) (#34428)
• Update to 7.5.10
  • [v7.5.x] Transformations: add 'prepare time series' transformer. [#36749]
• Update to 7.5.9
  • Login: Fix Unauthorized message that is displayed on sign-in or snapshot page. [#35880]

kiwi-desc-saltboot:

• Update to version 0.1.1639488226.7c9eab9
  • Enable one-time autosign grains for SLE12 and SLE11 clients

mgr-cfg:

• Version 4.3.3-1
  • Fix python selinux package name depending on build target (bsc#1193600)
  • Do not build python 2 package for SLE15SP4 and higher

mgr-custom-info:

• Version 4.3.3-1
  • require python macros for building

mgr-osad:

• Version 4.3.3-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

mgr-push:

• Version 4.3.2-1
  • Do not build python 2 package for SLE15SP4 and higher

mgr-virtualization:

• Version 4.3.2-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

python-hwdata:

• Require python macros for building

rhnlib:

• Version 4.3.2-1
  • do not build python 2 package for SLE15

salt:

• Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
• Fix the regression of docker_container state module (bsc#1191285)

spacecmd:

• Version 4.3.5-1
  • require python macros for building …

This update fixes the following issues:

ansible:

• Require python macros for building

grafana:

• Update to version 7.5.12:
  • Fix markdown path traversal (#42969, bsc#1193688, CVE-2021-43813)
• Recreate tarballs using the makefile to update the npm and go modules required
• Update to version 7.5.11:
  • Fix Snapshot authentication bypass (bsc#1191454, CVE-2021-39226)
  • Fix certs issue (#40002)
  • Release v7.5.11 (#124)
  • Fix static path matching issue in macaron
  • OAuth: add docs for disableAutoLogin param (#38752) (#38894)
  • Fix #747; remove 'other variables'. (#37866) (#37878)
  • Update alert docs (#33658) (#33659)
  • [7.5.x] Docs: added documentation for the 'prepare time series'-transformation. (#36836)
  • cherry picked dc5778c303ca555b70e8ca8c28e95997e26ecfc1 (#36813)
  • 'Release: Updated versions in package to 7.5.10' (#36792)
  • [v7.5.x] Transformations: add 'prepare time series' transformer (#36749)
  • Remove verify-drone from windows (#36775)
  • Update queries.md (#31941) (#36764)
  • Updated content to specify method to use to get keyboard shortcuts wh… (#36084) (#36087)
  • ReleaseNotes: Updated changelog and release notes for 7.5.9 (#36057) (#36077)
  • 'Release: Updated versions in package to 7.5.9' (#36056)
  • Login: Fixes Unauthorized message showing when on login page or snapshot page (#35311) (#35880)
  • ReleaseNotes: Updated changelog and release notes for 7.5.8 (#35703) (#35822)
  • CI: Upgrade pipeline tool to use main (#35804)
  • CI: try to force v7.5.x instead of master (#35799)
  • CI: supports move from master to main in 7.5.x release branch (#35747)
  • 'Release: Updated versions in package to 7.5.8' (#35701)
  • Chore: Bump acorn and lodash-es (#35650)
  • Snapshots: Remove dashboard links from snapshots (#35567) (#35585)
  • [v7.5.x] Datasource: Allow configuring MaxConnsPerHost (#35519)
  • Remove docs sync from v7.5.x (#35443)
  • 'Release: Updated versions in package to 7.5.7' (#35412)
  • Add max_idle_connections_per_host to config (#35365)
  • Update go.sum to fix failing enterprise pipeline (#35353)
  • [v7.5.x] HTTP Client: Introduce go-conntrack (#35321)
  • Fix Markdown syntax in enterprise/license/_index.md (#34683) (#35210)
  • Update annotations.md (#33218) (#35138)
  • Docs: Add query caching to enterprise docs page (#34751) (#35025)
  • [7.5.x] Admin: hide per role counts for licensed users (#34994)
  • cleanup shortcodes, image paths (#34827)
  • Security: Upgrade Thrift dependency (#34698) (#34702)
  • Docs: Fix Quick Start link on Geting Started Influx page (#34549) (#34603)
  • Add link to release notes v7.5.7 (#34460) (#34474)
  • Update 7.5.x landing page (#34447)
  • ReleaseNotes: Updated changelog and release notes for 7.5.7 (#34383) (#34428)
• Update to 7.5.10
  • [v7.5.x] Transformations: add 'prepare time series' transformer. [#36749]
• Update to 7.5.9
  • Login: Fix Unauthorized message that is displayed on sign-in or snapshot page. [#35880]
• Drop drop-grafana-aws-sdk-0.3.0-module.patch (upstream)

mgr-cfg:

• Version 4.3.4-1
  • Fix installation problem for SLE15SP4 due missing python-selinux
  • Fix python selinux package name depending on build target (bsc#1193600)
  • Do not build python 2 package for SLE15SP4 and higher

mgr-custom-info:

• Version 4.3.3-1
  • require python macros for building

mgr-osad:

• Version 4.3.3-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

mgr-push:

• Version 4.3.2-1
  • Do not build python 2 package for SLE15SP4 and higher

mgr-virtualization:

• Version 4.3.2-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

python-hwdata:

• Require python macros for building

rhnlib:

• Version 4.3.2-1
  • do not build python 2 package for SLE15

salt:

• Don't check for cached pillar errors on state.apply (bsc#1190781)

spacecmd:

• Version 4.3.5-1
  • require python macros for building

spacewalk-client-tools:

-…

This security update fixes the following issues:

golang-github-prometheus-prometheus:

• Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  • Bugfixes:
    • Scrape: Fix reporting metrics when sample limit is reached during the report. #9996
    • Scrape: Ensure that scrape interval and scrape timeout are always set. #10023
    • TSDB: Expose and fix bug in iterators' Seek() method. #10030
• Upgrade to upstream version 2.32.0
  • Change:
    • remote-write: Change default max retry time from 100ms to 5 seconds. #9634
  • Features:
    • Agent: New mode of operation optimized for remote-write only scenarios, without local storage.
    • Promtool: Add promtool check service-discovery command. #8970
  • Enhancements:
    • Promtool: Improve test output. #8064
    • Promtool: Use kahan summation for better numerical stability.
    • Remote-write: Reuse memory for marshalling. #9412
    • Scrape: Add scrape_body_size_bytes scrape metric behind the --enable-feature=extra-scrape-metrics flag. #9569
    • TSDB: Add windows arm64 support. #9703
    • TSDB: Optimize query by skipping unneeded sorting in TSDB.
    • Templates: Support int and uint as datatypes for template formatting. #9680
    • UI: Prefer rate over rad, delta over deg, and count over cos in autocomplete. #9688
    • TSDB: Add more size checks when writing individual sections in the index. #9710
    • PromQL: Make deriv() return zero values for constant series.
    • TSDB: Fix panic when checkpoint directory is empty. #9687
    • TSDB: Fix panic, out of order chunks, and race warning during WAL replay. #9856
    • UI: Correctly render links for targets with IPv6 addresses that contain a Zone ID. #9853
    • Promtool: Fix checking of authorization.credentials_file and bearer_token_file fields. #9883
    • Uyuni SD: Fix null pointer exception during initialization.
    • TSDB: Fix queries after a failed snapshot replay. #9980
• Upgrade to upstream version 2.31.1
  • Bugfix:
    • SD: Fix a panic when the experimental discovery manager receives targets during a reload. #9656
• Upgrade to upstream version 2.31.0
  • UI: Remove standard PromQL editor in favour of the codemirror-based editor. #9452
  • PromQL: Add trigonometric functions and atan2 binary operator. #9239 #9248 #9515
  • Remote: Add support for exemplar in the remote write receiver endpoint. #9319 #9414
  • SD: Add PuppetDB service discovery. #8883
  • SD: Add Uyuni service discovery. #8190
  • Web: Add support for security-related HTTP headers. #9546
  • Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  • Backfill: Add --max-block-duration in promtool create-blocks-from rules. #9511
  • Config: Print human-readable sizes with unit instead of raw numbers. #9361
  • HTTP: Re-enable HTTP/2. #9398
  • Kubernetes SD: Warn user if number of endpoints exceeds limit. #9467
  • OAuth2: Add TLS configuration to token requests. #9550
  • PromQL: Several optimizations. #9365 #9360 #9362 #9552
  • PromQL: Make aggregations deterministic in instant queries.
  • Rules: Add the ability to limit number of alerts or series.
  • SD: Experimental discovery manager to avoid restarts upon reload.
  • UI: Debounce timerange setting changes. #9359
  • Backfill: Apply rule labels after query labels. #9421
  • Scrape: Resolve conflicts between multiple exported label prefixes. #9479 #9518
  • Scrape: Restart scrape loops when scrape_interval is changed. #9551
  • TSDB: Fix memory leak in samples deletion. #9151
  • UI: Use consistent margin-bottom for all alert kinds. #9318
• Upgrade to upstream version 2.30.3
  • TSDB: Fix panic on failed snapshot replay. #9438
  • TSDB: Don't fail snapshot replay with exemplar storage disabled when the snapshot contains exemplars. #9438
• Upgrade to upstream version 2.30.2
  • TSDB: Don't error on…

This update fixes the following issues:

grafana:

• Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422)
  • Security:
    • Fixes XSS vulnerability in handling data sources (bsc#1195726, CVE-2022-21702)
    • Fixes cross-origin request forgery vulnerability (bsc#1195727, CVE-2022-21703)
    • Fixes Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728, CVE-2022-21713)
• Update to Go 1.17.
• Add build-time dependency on wire.
• Update license to GNU Affero General Public License v3.0.
• Update to version 8.3.4
  • GetUserInfo: return an error if no user was found (bsc#1194873, CVE-2022-21673)
  • Features and enhancements:
    • Alerting: Allow configuration of non-ready alertmanagers.
    • Alerting: Allow customization of Google chat message.
    • AppPlugins: Support app plugins with only default nav.
    • InfluxDB: query editor: skip fields in metadata queries.
    • Postgres/MySQL/MSSQL: Cancel in-flight SQL query if user cancels query in grafana.
    • Prometheus: Forward oauth tokens after prometheus datasource migration.
  • Bug fixes:
    • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
    • Azure Monitor: Improved error messages for variable queries.
    • CloudMonitoring: Fixes broken variable queries that use group bys.
    • Configuration: You can now see your expired API keys if you have no active ones.
    • Elasticsearch: Fix handling multiple datalinks for a single field.
    • Export: Fix error being thrown when exporting dashboards using query variables that reference the default datasource.
    • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
    • Login: Page no longer overflows on mobile.
    • Plugins: Set backend metadata property for core plugins.
    • Prometheus: Fill missing steps with null values.
    • Prometheus: Fix interpolation of $__rate_interval variable.
    • Prometheus: Interpolate variables with curly brackets syntax.
    • Prometheus: Respect the http-method data source setting.
    • Table: Fixes issue with field config applied to wrong fields when hiding columns.
    • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
    • Variables: Fix so data source variables are added to adhoc configuration.
  • Plugin development fixes & changes:
    • Toolkit: Revert build config so tslib is bundled with plugins to prevent plugins from crashing.
• Update to version 8.3.3:
  • BarChart: Use new data error view component to show actions in panel edit.
  • CloudMonitor: Iterate over pageToken for resources.
  • Macaron: Prevent WriteHeader invalid HTTP status code panic.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix so queryparam option works for scoped
• Update to version 8.3.2
  • Security: Fixes CVE-2021-43813 and CVE-2021-43815.
• Update to version 8.3.1
  • Security: Fixes CVE-2021-43798.
• Update to version…

This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues:

Security fixes included on the update:

ardana-barbican:

• Update policies to protect container secret access (SOC-11621)
• Update policies to protect secret metadata access (SOC-11620)

openstack-neutron:

• CVE-2021-40085: Fixed arbitrary dnsmasq reconfiguration via extra_dhcp_opts (bsc#1189794).

rubygem-sinatra:

• CVE-2022-29970: Fixed path traversal possible outside of public_dir when serving static files (bsc#1199138).

python-XStatic-jquery-ui:

• CVE-2021-41182: Fixed XSS in the altField option of the Datepicker widget (bsc#1192070)
• CVE-2021-41183: Fixed XSS in the of option of the .position() util (bsc#1192073)
• CVE-2021-41184: Fixed XSS in *Text options of the Datepicker widget (bsc#1192075)

python-lxml:

• CVE-2018-19787: Fixed that the lxml.html.clean module does remove javascript in lxml/html/clean.py (bsc#1118088).
• CVE-2020-27783: Fixed mXSS due to the use of improper parser (bsc#1179534).
• CVE-2021-28957: Fixed missing input sanitization for formaction HTML5 attributes that may have led to XSS (bsc#1184177).
• CVE-2021-43818: Fixed HTML Cleaner that allowed crafted and SVG embedded scripts to pass through (bsc#1193752).

openstack-barbican:

• CVE-2022-23451: Disallows authenticated users to add/modify/delete arbitrary metadata on any secret (bsc#1194952).
• CVE-2022-23452: Disallows anyone with an admin role to add their secrets to a different project's containers (bsc#1194954).

grafana:

• CVE-2021-44716: Fixed net/http: limit growth of header canonicalization cache (bsc#1193597).

openstack-keystone:

• CVE-2021-38155: Fixed information disclosure during account locking (bsc#1189390).

Non-security fixes included on the update:

Changes in ardana-barbican:

• Update to version 9.0+git.1644879908.8a641c1:

  • Update policies to protect container secret access (SOC-11621)

• Update to version 9.0+git.1643052417.9a3348e:

  • update policies to protect secret metadata access (SOC-11620)

Changes in grafana:

• Add CVE-2021-43813.patch (bsc#1193688, CVE-2021-43813)

  • directory traversal vulnerability for .md files

• Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)

  • Fix Go net/http: limit growth of header canonicalization cache

Changes in openstack-barbican:

• Add patches (0001-Fix-RBAC-and-ACL-access-for-managing-secret-containe.patch and 0001-Fix-policy-for-adding-a-secret-to-a-container.patch) to fix the legacy policy rules for adding a secret to a container and removing a secret from a container. bsc#1194954,CVE-2022-23452

• Add patch (0001-Fix-secret-metadata-access-rules.patch) to fix the legacy policy rules for accessing secret metadata by checking that the user making the request is authenticated for the project that owns the secret. bsc#1194952,CVE-2022-23451

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev24:
  • Correct group:reset_group_snapshot_status policy

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-14.0.1.dev4:

  • Add support for yoga

• Update to version group-based-policy-automation-14.0.1.dev3:

  • Python2/3 compatibility fixes

• Update to version group-based-policy-automation-14.0.1.dev2:

  • Add support for xena

• Update to version group-based-policy-automation-14.0.1.dev1:

  • Remove py27 from gate jobs 14.0.0

Changes in openstack-horizon-plugin-gbp-ui:

• Update to version group-based-policy-ui-14.0.1.dev3:

  • Add support for yoga

• Update to version group-based-policy-ui-14.0.1.dev2:

  • Python2/3 compatibility changes

• Update to version group-based-policy-ui-14.0.1.dev1:

  • Add support for xena …

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update required Go version to 1.16
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400)

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch that is already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Apply patch to capture permission denied error for 'energy_uj' file (bsc#1190535)

grafana:

• Update to…

This update for grafana fixes the following issues:

Updated to version 7.5.12:

• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688).
• CVE-2021-39226: Fixed Snapshot authentication bypass (bsc#1191454).

This update for grafana fixes the following issues:

Version update from 8.3.10 to 8.5.13 (jsc#PED-2145):

• Security fixes:

  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)

• Features and enhancements:

  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to api/ds/query
  • Rendering: Add support for renderer token
  • Setting: Support configuring feature toggles…

This update fixes the following issues:

dracut-saltboot:

• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8.

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins …

This update fixes the following issues:

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

ansible:

• Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
  • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
  • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
• Update to 2.9.22:
  • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
  • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)
• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Copy existing wicked config instead of generating new (bsc#1205599)
• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images
• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle
• Require e2fsprogs (bsc#1202614)
• Update to version 0.1.1657643023.0d694ce
  • Update dracut-saltboot dependencies (bsc#1200970)
  • Fix network loading when ipappend is used in pxe config
  • Add new information messages

golang-github-QubitProducts-exporter_exporter:

• Remove license file from %doc
• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Spec file clean up
• Fix apparmor profile for SLE 12
• Do not build with apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build with Go 1.19
• Build using promu
• Add _service file
• Fix sandboxing options
• Upgrade to version 0.13.4
  • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
• Upgrade to version 0.13.3
  • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

• Update to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API:…