CVE-2022-21703

Today we are releasing Grafana 8.3.5 and 7.5.15. This patch release includes MEDIUM severity security fix for Cross Site Request Forgery for Grafana.

Release v.8.3.5, only containing security fixes:

• Download Grafana 8.3.5
• Release notes

Release v.7.5.15, only containing security fixes:

• Download Grafana 7.5.15
• Release notes

CSRF (CVE-2022-21703)

Summary

On Jan. 18, security researchers jub0bs and abrahack contacted Grafana to disclose a CSRF vulnerability which allows anonymous attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins).

We believe that this vulnerability is rated at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).

Impact

An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges.

Affected versions with MEDIUM severity

All Grafana >=3.0-beta1 versions are affected by this vulnerability.

Solutions and mitigations

All installations after Grafana v3.0-beta1 should be upgraded as soon as possible.

Note that if you are running Grafana behind any reverse proxy, you need to make sure that you are passing the original Host and Origin headers from the client request to Grafana.

In the case of Apache Server, you need to add ProxyPreserveHost on in your proxy configuration. In case of NGINX, you can need to add proxy_set_header Host $http_host; in your configuration.

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana.

Timeline and postmortem

Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.

• 2022-01-18 03:00 Issue submitted by external researchers
• 2022-01-18 17:25 Vulnerability confirmed reproducible
• 2022-01-19 07:40 CVSS score confirmed 6.8 at maximum and MEDIUM impact
• 2022-01-19 07:40 Begin mitigation for Grafana Cloud
• 2022-01-19 17:00 CVE requested
• 2022-01-19 19:50 GitHub issues CVE-2022-21703
• 2022-01-21 10:50 PR with fix opened
• 2022-01-21 14:13 Private release planned for 2022-01-25, and public release planned for 2022-02-01.
• 2022-01-25 12:00 Private release
• 2022-02-01 12:00 During the public release process, we realized that private 7.x release was incomplete. Abort public release, send second private release to customers using 7.x
• 2022-02-08 12:00 Public release

Acknowledgement

We would like to thank jub0bs and abrahack for responsibly disclosing the vulnerability.

Reporting security issues

If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

###…

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB and OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.(CVE-2022-21703)

Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. /teams/:teamId will allow an authenticated attacker to view unintended data by querying for the specific team ID, /teams/:search will allow an authenticated attacker to search for teams and see the total number of available teams, including for those teams that the user does not have access to, and /teams/:teamId/members when editors_can_admin flag is enabled, an authenticated attacker can see unintended data by querying for the specific team ID. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.(CVE-2022-21713)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)

• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

• grafana: XSS vulnerability in data source handling (CVE-2022-21702)

• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)

• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)

• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)

• grafana: XSS vulnerability in data source handling (CVE-2022-21702)

• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)

• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055348)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
• grafana: XSS vulnerability in data source handling (CVE-2022-21702)
• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.15). (BZ#2055349)

Security Fix(es):

• sanitize-url: XSS due to improper sanitization in sanitizeUrl function (CVE-2021-23648)
• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• grafana: Forward OAuth Identity Token can allow users to access some data sources (CVE-2022-21673)
• prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
• grafana: XSS vulnerability in data source handling (CVE-2022-21702)
• grafana: CSRF vulnerability can lead to privilege escalation (CVE-2022-21703)
• grafana: IDOR vulnerability can lead to information disclosure (CVE-2022-21713)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-privilege Grafana users (for example, Editors or Admins). An attacker can exploit this vulnerability for privilege escalation by tricking an authenticated user into inviting the attacker as a new user with high privileges. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.

These are all security issues fixed in the grafana-8.3.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23422)

• Security:

  • CVE-2022-21702: XSS vulnerability in handling data sources (bsc#1195726)
  • CVE-2022-21703: cross-origin request forgery vulnerability (bsc#1195727)
  • CVE-2022-21713: Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728)
  • CVE-2022-21673: GetUserInfo: return an error if no user was found (bsc#1194873)
  • CVE-2021-43813, CVE-2021-43815, CVE-2021-41244, CVE-2021-41174, CVE-2021-43798, CVE-2021-39226.
  • Upgrade Docker base image to Alpine 3.14.3.
  • CVE-2021-3711: Docker: Force use of libcrypto1.1 and libssl1.1 versions
  • Update dependencies to fix CVE-2021-36222.
  • Upgrade Go to 1.17.2.
  • Fix stylesheet injection vulnerability.
  • Fix short URL vulnerability.

• License update:

  • AGPL License: Update license from Apache 2.0 to the GNU Affero General Public License (AGPL).

• Breaking changes:

  • Grafana 8 Alerting enabled by default for installations that do not use legacy alerting.
  • Keep Last State for 'If execution error or timeout' when upgrading to Grafana 8 alerting.
  • Fix No Data behaviour in Legacy Alerting.
  • The following endpoints were deprecated for Grafana v5.0 and support for them has now been removed:
    • GET /dashboards/db/:slug
    • GET /dashboard-solo/db/:slug
    • GET /api/dashboard/db/:slug
    • DELETE /api/dashboards/db/:slug
  • The default HTTP method for Prometheus data source is now POST.
  • Removes the never refresh option for Query variables.
  • Removes the experimental Tags feature for Variables.

• Deprecations:

  • The InfoBox & FeatureInfoBox are now deprecated please use the Alert component instead with severity info.

• Bug fixes:

  • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
  • Azure Monitor: Improved error messages for variable queries.
  • CloudMonitoring: Fixes broken variable queries that use group bys.
  • Configuration: You can now see your expired API keys if you have no active ones.
  • Elasticsearch: Fix handling multiple datalinks for a single field.
  • Export: Fix error when exporting dashboards using query variables that reference the default datasource.
  • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
  • Login: Page no longer overflows on mobile.
  • Plugins: Set backend metadata property for core plugins.
  • Prometheus: Fill missing steps with null values.
  • Prometheus: Fix interpolation of $__rate_interval variable.
  • Prometheus: Interpolate variables with curly brackets syntax.
  • Prometheus: Respect the http-method data source setting.
  • Table: Fixes issue with field config applied to wrong fields when hiding columns.
  • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
  • Variables: Fix so data source variables are added to adhoc configuration.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix…

This security update fixes the following issues:

golang-github-prometheus-prometheus:

• Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  • Bugfixes:
    • Scrape: Fix reporting metrics when sample limit is reached during the report. #9996
    • Scrape: Ensure that scrape interval and scrape timeout are always set. #10023
    • TSDB: Expose and fix bug in iterators' Seek() method. #10030
• Upgrade to upstream version 2.32.0
  • Change:
    • remote-write: Change default max retry time from 100ms to 5 seconds. #9634
  • Features:
    • Agent: New mode of operation optimized for remote-write only scenarios, without local storage.
    • Promtool: Add promtool check service-discovery command. #8970
  • Enhancements:
    • Promtool: Improve test output. #8064
    • Promtool: Use kahan summation for better numerical stability.
    • Remote-write: Reuse memory for marshalling. #9412
    • Scrape: Add scrape_body_size_bytes scrape metric behind the --enable-feature=extra-scrape-metrics flag. #9569
    • TSDB: Add windows arm64 support. #9703
    • TSDB: Optimize query by skipping unneeded sorting in TSDB.
    • Templates: Support int and uint as datatypes for template formatting. #9680
    • UI: Prefer rate over rad, delta over deg, and count over cos in autocomplete. #9688
    • TSDB: Add more size checks when writing individual sections in the index. #9710
    • PromQL: Make deriv() return zero values for constant series.
    • TSDB: Fix panic when checkpoint directory is empty. #9687
    • TSDB: Fix panic, out of order chunks, and race warning during WAL replay. #9856
    • UI: Correctly render links for targets with IPv6 addresses that contain a Zone ID. #9853
    • Promtool: Fix checking of authorization.credentials_file and bearer_token_file fields. #9883
    • Uyuni SD: Fix null pointer exception during initialization.
    • TSDB: Fix queries after a failed snapshot replay. #9980
• Upgrade to upstream version 2.31.1
  • Bugfix:
    • SD: Fix a panic when the experimental discovery manager receives targets during a reload. #9656
• Upgrade to upstream version 2.31.0
  • UI: Remove standard PromQL editor in favour of the codemirror-based editor. #9452
  • PromQL: Add trigonometric functions and atan2 binary operator. #9239 #9248 #9515
  • Remote: Add support for exemplar in the remote write receiver endpoint. #9319 #9414
  • SD: Add PuppetDB service discovery. #8883
  • SD: Add Uyuni service discovery. #8190
  • Web: Add support for security-related HTTP headers. #9546
  • Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  • Backfill: Add --max-block-duration in promtool create-blocks-from rules. #9511
  • Config: Print human-readable sizes with unit instead of raw numbers. #9361
  • HTTP: Re-enable HTTP/2. #9398
  • Kubernetes SD: Warn user if number of endpoints exceeds limit. #9467
  • OAuth2: Add TLS configuration to token requests. #9550
  • PromQL: Several optimizations. #9365 #9360 #9362 #9552
  • PromQL: Make aggregations deterministic in instant queries.
  • Rules: Add the ability to limit number of alerts or series.
  • SD: Experimental discovery manager to avoid restarts upon reload.
  • UI: Debounce timerange setting changes. #9359
  • Backfill: Apply rule labels after query labels. #9421
  • Scrape: Resolve conflicts between multiple exported label prefixes. #9479 #9518
  • Scrape: Restart scrape loops when scrape_interval is changed. #9551
  • TSDB: Fix memory leak in samples deletion. #9151
  • UI: Use consistent margin-bottom for all alert kinds. #9318
• Upgrade to upstream version 2.30.3
  • TSDB: Fix panic on failed snapshot replay. #9438
  • TSDB: Don't fail snapshot replay with exemplar storage disabled when the snapshot contains exemplars. #9438
• Upgrade to upstream version 2.30.2
  • TSDB: Don't error on…

This update fixes the following issues:

grafana:

• Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422)
  • Security:
    • Fixes XSS vulnerability in handling data sources (bsc#1195726, CVE-2022-21702)
    • Fixes cross-origin request forgery vulnerability (bsc#1195727, CVE-2022-21703)
    • Fixes Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728, CVE-2022-21713)
• Update to Go 1.17.
• Add build-time dependency on wire.
• Update license to GNU Affero General Public License v3.0.
• Update to version 8.3.4
  • GetUserInfo: return an error if no user was found (bsc#1194873, CVE-2022-21673)
  • Features and enhancements:
    • Alerting: Allow configuration of non-ready alertmanagers.
    • Alerting: Allow customization of Google chat message.
    • AppPlugins: Support app plugins with only default nav.
    • InfluxDB: query editor: skip fields in metadata queries.
    • Postgres/MySQL/MSSQL: Cancel in-flight SQL query if user cancels query in grafana.
    • Prometheus: Forward oauth tokens after prometheus datasource migration.
  • Bug fixes:
    • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
    • Azure Monitor: Improved error messages for variable queries.
    • CloudMonitoring: Fixes broken variable queries that use group bys.
    • Configuration: You can now see your expired API keys if you have no active ones.
    • Elasticsearch: Fix handling multiple datalinks for a single field.
    • Export: Fix error being thrown when exporting dashboards using query variables that reference the default datasource.
    • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
    • Login: Page no longer overflows on mobile.
    • Plugins: Set backend metadata property for core plugins.
    • Prometheus: Fill missing steps with null values.
    • Prometheus: Fix interpolation of $__rate_interval variable.
    • Prometheus: Interpolate variables with curly brackets syntax.
    • Prometheus: Respect the http-method data source setting.
    • Table: Fixes issue with field config applied to wrong fields when hiding columns.
    • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
    • Variables: Fix so data source variables are added to adhoc configuration.
  • Plugin development fixes & changes:
    • Toolkit: Revert build config so tslib is bundled with plugins to prevent plugins from crashing.
• Update to version 8.3.3:
  • BarChart: Use new data error view component to show actions in panel edit.
  • CloudMonitor: Iterate over pageToken for resources.
  • Macaron: Prevent WriteHeader invalid HTTP status code panic.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix so queryparam option works for scoped
• Update to version 8.3.2
  • Security: Fixes CVE-2021-43813 and CVE-2021-43815.
• Update to version 8.3.1
  • Security: Fixes CVE-2021-43798.
• Update to version…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update required Go version to 1.16
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400)

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch that is already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Apply patch to capture permission denied error for 'energy_uj' file (bsc#1190535)

grafana:

• Update to…

This update for grafana fixes the following issues:

Updated to version 8.5.13 (jsc#PED-2145, jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565):

• CVE-2022-36062: Fixed RBAC folders/dashboards privilege escalation (bsc#1203596).
• CVE-2022-35957: Fixed escalation from admin to server admin when auth proxy is used (bsc#1203597).
• CVE-2022-31107: Fixed OAuth account takeover (bsc#1201539).
• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-21702: Fixed XSS vulnerability in handling data sources (bsc#1195726).
• CVE-2022-21703: Fixed cross-origin request forgery vulnerability (bsc#1195727).
• CVE-2022-21713: Fixed Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728).
• CVE-2022-21673: Fixed missing error return in GetUserInfo if no user was found (bsc#1194873).
• CVE-2021-43815: Fixed directory traversal for .csv files (bsc#1193686).
• CVE-2021-41244: Fixed incorrect access control vulnerability(bsc#1192763).
• CVE-2021-41174: Fixed XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL (bsc#1192383).
• CVE-2021-3711: Fixed SM2 Decryption Buffer Overflow (bsc#1189520).
• CVE-2021-36222: Fixed a null pointer dereference in the KDC (bsc#1188571).
• CVE-2021-43798: Fixed arbitrary file read in the graph native plugin (bsc#1193492).

This update for grafana fixes the following issues:

Updated to version 8.3.10 (jsc#SLE-24565, jsc#SLE-23422, jsc#SLE-23439):

• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-31107: Fixed OAuth account takeover vulnerability (bsc#1201539).
• CVE-2022-21702: Fixed XSS through attacker-controlled data source (bsc#1195726).
• CVE-2022-21703: Fixed Cross Site Request Forgery (bsc#1195727).
• CVE-2022-21713: Fixed Teams API IDOR (bsc#1195728).

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…