CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

Impact

Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication.

Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back.

However, a flaw in the way this mechanism was implemented in the exporter toolkit makes it possible with people who know the hashed password to authenticate against Prometheus.

A request can be forged by an attacker to poison the internal cache used to cache the computation of hashes and make subsequent requests successful. This cache is used in both happy and unhappy scenarios in order to limit side channel attacks that could tell an attacker if a user is present in the file or not.

Patches

The exporter-toolkit v0.7.3 and v0.8.2 have been released to address this issue.

Workarounds

There is no workaround but attacker must have access to the hashed password, stored in disk, to bypass the authentication.

Credit

We want to thank Lei Wan reporting this security issue.

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

If an attacker has access to a Prometheus web.yml file and users' bcrypted passwords, it would be possible to bypass security via the built-in authentication cache.

These are all security issues fixed in the golang-github-prometheus-node_exporter-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-prometheus-prometheus-2.41.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the prometheus-ha_cluster_exporter-1.3.1+git.1676027782.ad3c0e9-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-8.5.20-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the prometheus-postgres_exporter-0.10.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the prometheus-blackbox_exporter-0.19.0-13.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-lusitaniae-apache_exporter-1.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

prometheus-postgres_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
• Other non-security issues fixed:
  • Adapt the systemd service security configuration to be able to start it on for Red Hat Linux Enterprise systems and clones
  • Add hardening to systemd service(s) (bsc#1181400)
  • Create the prometheus user for Red Hat Linux Enterprise systems and clones
  • Fix broken log-level for values other than debug (bsc#1208965)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version upgrade to 1.5.0:
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0:
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [CHANGE] Default GOMAXPROCS to 1
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds against older macOS SDK
  • [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
  • [ENHANCEMENT] systemd: Expose systemd minor version
  • [ENHANCEMENT] Use netlink for tcpstat collector
  • [ENHANCEMENT] Use netlink to get netdev stats
  • [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
  • [ENHANCEMENT] Add btrfs device error stats

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Changes and bugs fixed:
  • Updated to 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Changes from 0.13.1
    • Fix panic caused by missing flagConfig options
  • Changes from 0.11.0 (jsc#SLE-24791)
    • Add TLS support
    • Switch to logger, please check --log.level and --log.format flags
  • Changes from 0.10.1
    • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
  • Changes from 0.10.0
    • Add Apache Proxy and other metrics
  • Changes from 0.8.0
    • Change commandline flags
    • Add metrics: Apache version, request duration total
  • Changes from 0.7.0
    • Handle OS TERM signals
  • Changes from 0.6.0
    • Add option to override host name
  • Added support for Red Hat Enterprise Linux
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Build using promu
  • Build with Go 1.19
  • Exclude s390 architecture

golang-github-prometheus-node_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

golang-github-QubitProducts-exporter_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

prometheus-postgres_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

scap-security-guide:

• Updated to 0.1.69 (jsc#ECO-3319)
  • Introduce a JSON build manifest
  • Introduce a script to compare ComplianceAsCode versions
  • Introduce CCN profiles for Red Hat Enterprise Linux 9
  • Map rules to components
  • products/anolis23: supports Anolis OS 23
  • Render components to HTML
  • Store rendered control files
  • Test and use rules to components mapping
  • Use distributed product properties
• Revert patch that breaks the SLE hardening (bsc#1213691)
• Changes from 0.1.68 (jsc#ECO-3319)
  • Bump OL8 STIG version to V1R6
  • Introduce a Product class, make the project work with it
  • Introduce Fedora and Firefox CaC profiles for common workstation users
  • OL7 DISA STIG v2r11 update
  • Publish rendered policy artifacts
  • Update ANSSI BP-028 to version 2.0
• Changes from 0.1.67 (jsc#ECO-3319)
  • Add utils/controlrefcheck.py
  • Red Hat Enterprise Linux 9 STIG Update Q1 2023
  • Include warning for NetworkManager keyfiles in Red Hat Enterprise Linux 9
  • OL7 stig v2r10 update
  • Bump version of OL8 STIG to V1R5
• Various enhancements to SLE profiles

spacecmd:

• Updated to 4.3.23-1
  • Update translation strings

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.6

  • Salt has been upgraded to 3006.0

  • SUSE Linux Enterprise Server 15 SP5 Family support has been added

  • SUSE Linux Enterprise Server Micro 5.4 support has been added

  • openSUSE Leap 15.5 support has been added

  • Ability to install PTFs from SUSE Manager has been added

  • Scheduling Custom States on recurrent basis is now possible

  • Syncing optional channels from the webUI is now possible

  • All Tomcat logs are now rotated with logrotate

  • Grafana upgraded to 9.5.1

  • Node exporter upgraded to 1.5.0

  • Prometheus upgraded to 2.37.6

  • Postgres exporter upgraded to 0.10.1

  • CVEs fixed CVE-2023-22644, CVE-2022-46146

  • Bugs mentioned

    bsc#1201063, bsc#1203599, bsc#1204089, bsc#1204270, bsc#1204900 bsc#1205600, bsc#1206060, bsc#1206191, bsc#1206423, bsc#1206725 bsc#1206783, bsc#1207063, bsc#1207595, bsc#1207814, bsc#1207829 bsc#1207830, bsc#1208288, bsc#1208321, bsc#1208427, bsc#1208522 bsc#1208536, bsc#1208540, bsc#1208550, bsc#1208586, bsc#1208661 bsc#1208687, bsc#1208719, bsc#1208772, bsc#1209143, bsc#1209149 bsc#1209215, bsc#1209220, bsc#1209231, bsc#1209253, bsc#1209277 bsc#1209386, bsc#1209395, bsc#1209508, bsc#1209557, bsc#1209926 bsc#1209938, bsc#1209993, bsc#1210086, bsc#1210094, bsc#1210101 bsc#1210107, bsc#1210154, bsc#1210162, bsc#1210349, bsc#1210437 bsc#1210458, bsc#1210835, bsc#1211958, bsc#1210776, bsc#1209434 bsc#1208046, bsc#1212363, bsc#1212096, bsc#1212516

This update for prometheus-ha_cluster_exporter fixes the following issues:

Updated to version 1.3.1:

• CVE-2022-46146: Fixed authentication bypass via cache poisoning in prometheus/exporter-toolkit (bsc#1208046, bsc#1208047).

This update for prometheus-ha_cluster_exporter fixes the following issues:

Updated to version 1.3.1:

• CVE-2022-46146: Fixed authentication bypass via cache poisoning in prometheus/exporter-toolkit (bsc#1208046, bsc#1208047).

This update for prometheus-ha_cluster_exporter fixes the following issues:

Updated to version 1.3.1:

• CVE-2022-46146: Fixed authentication bypass via cache poisoning in prometheus/exporter-toolkit (bsc#1208046, bsc#1208047).

This update fixes the following issues:

grafana:

• CVE-2022-46146: Fix basic authentication bypass by updating the exporter toolkit to version 0.7.3 (bsc#1208065)
• CVE-2022-41723: Require Go 1.19 or newer (bsc#1208293)
• Update to version 8.5.20:
  • CVE-2022-23552: Security: SVG: Add dompurify preprocessor step (bsc#1207749)
  • CVE-2022-39324: Security: Snapshots: Fix originalUrl spoof security issue (bsc#1207750)
  • Security: Omit error from http response
  • Bug fix: Email and username trimming and invitation validation

spacecmd:

• Version 4.3.19-1
  • Fix spacecmd not showing any output for softwarechannel_diff and softwarechannel_errata_diff (bsc#1207352)
  • Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759)

spacewalk-client-tools:

• Version 4.3.15-1
  • Update translation strings

This update fixes the following issues:

dracut-saltboot:

• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd

grafana:

• CVE-2022-46146: Fix basic authentication bypass by updating the exporter toolkit to version 0.7.3 (bsc#1208065,)
• CVE-2022-41723: Require Go 1.19 or newer (bsc#1208293)
• Update to version 8.5.20:
  • CVE-2022-23552: Security: SVG: Add dompurify preprocessor step (bsc#1207749)
  • CVE-2022-39324: Security: Snapshots: Fix originalUrl spoof security issue (bsc#1207750)
  • Security: Omit error from http response
  • Bug fix: Email and username trimming and invitation validation

spacecmd:

• Version 4.3.19-1
  • Fix spacecmd not showing any output for softwarechannel_diff and softwarechannel_errata_diff (bsc#1207352)
  • Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759)

spacewalk-client-tools:

• Version 4.3.15-1
  • Update translation strings

supportutils-plugin-salt:

• Update to version 1.2.2
  • Remove possible passwords from Salt configuration files (bsc#1201059)

uyuni-proxy-systemd-services:

• Version 4.3.8-1
  • Allow using container images from different registry paths

This update for grafana fixes the following issues:

• CVE-2022-23552: Fixed SVG processing by adding a dompurify preprocessor step (bsc#1207749).
• CVE-2022-39324: Fixed originalUrl spoof security issue (bsc#1207750).
• CVE-2022-41723: Fixed go issue to avoid quadratic complexity in HPACK decoding (bsc#1208293).
• CVE-2022-46146: Fixed basic authentication bypass by updating the exporter toolkit (bsc#1208065).
• Trim leading and trailing whitespaces from email and username on signup
• Fix invitation validation: Check whether the provided email address is the same as where the invitation is sent

This update for golang-github-prometheus-prometheus fixes the following issues:

• CVE-2022-46146: Fixed authentication bypass via cache poisoning in Prometheus Exporter Toolkit (bsc#1208049).

This update for golang-github-prometheus-prometheus fixes the following issues:

• CVE-2022-46146: Fixed authentication bypass via cache poisoning in Prometheus Exporter Toolkit (bsc#1208049).

This update for golang-github-prometheus-prometheus fixes the following issues:

• CVE-2022-46146: Fixed authentication bypass via cache poisoning in Prometheus Exporter Toolkit (bsc#1208049).

This update fixes the following issues:

prometheus-blackbox_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208062)
• Other non-security bugs fixed and changes:
  • Add min_version parameter of tls_config to allow enabling TLS 1.0 and 1.1 (bsc#1209113)
  • On SUSE Linux Enterprise build always with Go >= 1.19 (bsc#1203599)

prometheus-postgres_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
• Other non-security bugs fixed and changes:
  • Adapt the systemd service security configuration to be able to start it on for Red Hat Linux Enterprise systems and clones
  • Create the prometheus user for Red Hat Linux Enterprise systems and clones
  • Fix broken log-level for values other than debug (bsc#1208965)

golang-github-prometheus-prometheus:

• Security issues fixed in this version update to 2.37.6:
  • CVE-2022-46146: Fix basic authentication bypass vulnerability (bsc#1208049, jsc#PED-3576)
  • CVE-2022-41715: Update our regexp library to fix upstream (bsc#1204023)
• Other non-security bugs fixed and changes in this version update to 2.37.6:
  • [BUGFIX] TSDB: Turn off isolation for Head compaction to fix a memory leak.
  • [BUGFIX] TSDB: Fix 'invalid magic number 0' error on Prometheus startup.
  • [BUGFIX] Agent: Fix validation of flag options and prevent WAL from growing more than desired.
  • [BUGFIX] Properly close file descriptor when logging unfinished queries.
  • [BUGFIX] TSDB: In the WAL watcher metrics, expose the type='exemplar' label instead of type='unknown' for exemplar records.
  • [BUGFIX] Alerting: Fix Alertmanager targets not being updated when alerts were queued.
  • [BUGFIX] Hetzner SD: Make authentication files relative to Prometheus config file.
  • [BUGFIX] Promtool: Fix promtool check config not erroring properly on failures.
  • [BUGFIX] Scrape: Keep relabeled scrape interval and timeout on reloads.
  • [BUGFIX] TSDB: Don't increment prometheus_tsdb_compactions_failed_total when context is canceled.
  • [BUGFIX] TSDB: Fix panic if series is not found when deleting series.
  • [BUGFIX] TSDB: Increase prometheus_tsdb_mmap_chunk_corruptions_total on out of sequence errors.
  • [BUGFIX] Uyuni SD: Make authentication files relative to Prometheus configuration file and fix default configuration values.
  • [BUGFIX] Fix serving of static assets like fonts and favicon.
  • [BUGFIX] promtool: Add --lint-fatal option.
  • [BUGFIX] Changing TotalQueryableSamples from int to int64.
  • [BUGFIX] tsdb/agent: Ignore duplicate exemplars.
  • [BUGFIX] TSDB: Fix chunk overflow appending samples at a variable rate.
  • [BUGFIX] Stop rule manager before TSDB is stopped.
  • [BUGFIX] Kubernetes SD: Explicitly include gcp auth from k8s.io.
  • [BUGFIX] Fix OpenMetrics parser to sort uppercase labels correctly.
  • [BUGFIX] UI: Fix scrape interval and duration tooltip not showing on target page.
  • [BUGFIX] Tracing/GRPC: Set TLS credentials only when insecure is false.
  • [BUGFIX] Agent: Fix ID collision when loading a WAL with multiple segments.
  • [BUGFIX] Remote-write: Fix a deadlock between Batch and flushing the queue.
  • [BUGFIX] PromQL: Properly return an error from histogram_quantile when metrics have the same labelset.
  • [BUGFIX] UI: Fix bug that sets the range input to the resolution.
  • [BUGFIX] TSDB: Fix a query panic when memory-snapshot-on-shutdown is enabled.
  • [BUGFIX] Parser: Specify type in metadata parser errors.
  • [BUGFIX] Scrape: Fix label limit changes not applying.
  • [BUGFIX] Remote-write: Fix deadlock between adding to queue and getting batch.
  • [BUGFIX] TSDB: Fix panic when m-mapping head chunks onto the disk.
  • [BUGFIX] Azure SD: Fix a regression when public IP Address isn't set.
  • [BUGFIX] Azure SD: Fix panic when public IP Address isn't set.
  • [BUGFIX] Remote-write: Fix deadlock when stopping a shard.
  • [BUGFIX] SD: Fix no…

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)

prometheus-blackbox_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208062)
• Other non-security bugs fixed and changes:
  • Add min_version parameter of tls_config to allow enabling TLS 1.0 and 1.1 (bsc#1209113)
  • On SUSE Linux Enterprise build always with Go >= 1.19 (bsc#1203599)

prometheus-postgres_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
• Other non-security issues fixed:
  • Adapt the systemd service security configuration to be able to start it on for Red Hat Linux Enterprise systems and clones
  • Create the prometheus user for Red Hat Linux Enterprise systems and clones
  • Fix broken log-level for values other than debug (bsc#1208965)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [BUGFIX] Handle nil CPU thermal power status on M1
  • [BUGFIX] bsd: Ignore filesystems flagged as MNT_IGNORE
  • [BUGFIX] Sanitize UTF-8 in dmi collector
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds…

This update fixes the following issues:

prometheus-postgres_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
• Other non-security issues fixed:
  • Adapt the systemd service security configuration to be able to start it on for Red Hat Linux Enterprise systems and clones
  • Add hardening to systemd service(s) (bsc#1181400)
  • Create the prometheus user for Red Hat Linux Enterprise systems and clones
  • Fix broken log-level for values other than debug (bsc#1208965)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version upgrade to 1.5.0:
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0:
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [CHANGE] Default GOMAXPROCS to 1
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds against older macOS SDK
  • [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
  • [ENHANCEMENT] systemd: Expose systemd minor version
  • [ENHANCEMENT] Use netlink for tcpstat collector
  • [ENHANCEMENT] Use netlink to get netdev stats
  • [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
  • [ENHANCEMENT] Add btrfs device error stats

This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:

golang-github-prometheus-alertmanager:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [BUGFIX] Handle nil CPU thermal power status on M1
  • [BUGFIX] bsd: Ignore filesystems flagged as MNT_IGNORE
  • [BUGFIX] Sanitize UTF-8 in dmi collector
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds against older macOS SDK
  • [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
  • [ENHANCEMENT] systemd: Expose systemd minor version
  • [ENHANCEMENT] Use netlink for tcpstat collector
  • [ENHANCEMENT] Use netlink to get netdev stats
  • [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
  • [ENHANCEMENT] Add btrfs device error stats
• Change build requirement to go1.18 or higher (previously this was fixed to version 1.14)

This update fixes the following issues:

bind:

• Provide bind dependencies and solve installation issues on SUSE Linux Enterprise Micro
• There are no source changes

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from…

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

release-notes-susemanager:

• Update to 4.2.13
  • Salt has been upgraded to 3006.0
  • SUSE Linux Enterprise Server 15 SP5 Family support has been added
  • openSUSE Leap 15.5 support has been added
  • Automatic migration from Salt 3000 to Salt bundle
  • Grafana upgraded to 9.5.1
  • Node exporter upgraded to 1.5.0
  • Prometheus upgraded to 2.37.6
  • Postgres exporter upgraded to 0.10.1
  • CVEs fixed: CVE-2023-22644, CVE-2022-46146
  • Bugs mentioned: bsc#1179747, bsc#1186011, bsc#1203599, bsc#1205600, bsc#1206423 bsc#1207550, bsc#1207814, bsc#1207941, bsc#1208984, bsc#1209220 bsc#1209231, bsc#1209277, bsc#1209386, bsc#1209434, bsc#1209508 bsc#1209877, bsc#1209915, bsc#1209926, bsc#1210011, bsc#1210086 bsc#1210101, bsc#1210107, bsc#1210154, bsc#1210162, bsc#1210232 bsc#1210311, bsc#1210406, bsc#1210437, bsc#1210458, bsc#1210659 bsc#1210835, bsc#1210957, bsc#1211330, bsc#1208046, bsc#1212517 bsc#1212096

This update for golang-github-prometheus-prometheus fixes the following issues:

golang-github-prometheus-prometheus:

• Security issues fixed in this version update to 2.37.6:
  • CVE-2022-46146: Fix basic authentication bypass vulnerability (bsc#1208049, jsc#PED-3576)
  • CVE-2022-41715: Update our regexp library to fix upstream (bsc#1204023)
  • CVE-2022-41723: Fixed go issue to avoid quadratic complexity in HPACK decoding (bsc#1208298)
• Other non-security bugs fixed and changes in this version update to 2.37.6:
  • [BUGFIX] TSDB: Turn off isolation for Head compaction to fix a memory leak.
  • [BUGFIX] TSDB: Fix 'invalid magic number 0' error on Prometheus startup.
  • [BUGFIX] Agent: Fix validation of flag options and prevent WAL from growing more than desired.
  • [BUGFIX] Properly close file descriptor when logging unfinished queries.
  • [BUGFIX] TSDB: In the WAL watcher metrics, expose the type='exemplar' label instead of type='unknown' for exemplar records.
  • [BUGFIX] Alerting: Fix Alertmanager targets not being updated when alerts were queued.
  • [BUGFIX] Hetzner SD: Make authentication files relative to Prometheus config file.
  • [BUGFIX] Promtool: Fix promtool check config not erroring properly on failures.
  • [BUGFIX] Scrape: Keep relabeled scrape interval and timeout on reloads.
  • [BUGFIX] TSDB: Don't increment prometheus_tsdb_compactions_failed_total when context is canceled.
  • [BUGFIX] TSDB: Fix panic if series is not found when deleting series.
  • [BUGFIX] TSDB: Increase prometheus_tsdb_mmap_chunk_corruptions_total on out of sequence errors.
  • [BUGFIX] Uyuni SD: Make authentication files relative to Prometheus configuration file and fix default configuration values.
  • [BUGFIX] Fix serving of static assets like fonts and favicon.
  • [BUGFIX] promtool: Add --lint-fatal option.
  • [BUGFIX] Changing TotalQueryableSamples from int to int64.
  • [BUGFIX] tsdb/agent: Ignore duplicate exemplars.
  • [BUGFIX] TSDB: Fix chunk overflow appending samples at a variable rate.
  • [BUGFIX] Stop rule manager before TSDB is stopped.
  • [BUGFIX] Kubernetes SD: Explicitly include gcp auth from k8s.io.
  • [BUGFIX] Fix OpenMetrics parser to sort uppercase labels correctly.
  • [BUGFIX] UI: Fix scrape interval and duration tooltip not showing on target page.
  • [BUGFIX] Tracing/GRPC: Set TLS credentials only when insecure is false.
  • [BUGFIX] Agent: Fix ID collision when loading a WAL with multiple segments.
  • [BUGFIX] Remote-write: Fix a deadlock between Batch and flushing the queue.
  • [BUGFIX] PromQL: Properly return an error from histogram_quantile when metrics have the same labelset.
  • [BUGFIX] UI: Fix bug that sets the range input to the resolution.
  • [BUGFIX] TSDB: Fix a query panic when memory-snapshot-on-shutdown is enabled.
  • [BUGFIX] Parser: Specify type in metadata parser errors.
  • [BUGFIX] Scrape: Fix label limit changes not applying.
  • [BUGFIX] Remote-write: Fix deadlock between adding to queue and getting batch.
  • [BUGFIX] TSDB: Fix panic when m-mapping head chunks onto the disk.
  • [BUGFIX] Azure SD: Fix a regression when public IP Address isn't set.
  • [BUGFIX] Azure SD: Fix panic when public IP Address isn't set.
  • [BUGFIX] Remote-write: Fix deadlock when stopping a shard.
  • [BUGFIX] SD: Fix no such file or directory in K8s SD when not running inside K8s.
  • [BUGFIX] Promtool: Make exit codes more consistent.
  • [BUGFIX] Promtool: Fix flakiness of rule testing.
  • [BUGFIX] Remote-write: Update prometheus_remote_storage_queue_highest_sent_timestamp_seconds metric when write irrecoverably fails.
  • [BUGFIX] Storage: Avoid panic in BufferedSeriesIterator.
  • [BUGFIX] TSDB: CompactBlockMetas should produce correct mint/maxt for overlapping blocks.
  • [BUGFIX] TSDB: Fix logging of exemplar storage size.
  • [BUGFIX] UI: Fix overlapping click targets for the alert state checkboxes.
  • [BUGFIX] UI: Fix Unhealthy filter on target page to actually display…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Changes and bugs fixed:
  • Updated to 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Changes from 0.13.1
    • Fix panic caused by missing flagConfig options
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Build using promu
  • Build with Go 1.19
  • Exclude s390 architecture

golang-github-prometheus-alertmanager:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

golang-github-prometheus-node_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

golang-github-prometheus-prometheus:

• This update introduces breaking changes. Please, read carefully the provided informations.
• Security issues fixed:
  • CVE-2022-41723: Fix uncontrolled resource consumption by updating Go to version 1.20.1 (bsc#1208298)
• Updated to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API: New limit parameter to limit the number of items returned by /api/v1/status/tsdb endpoint
  • [FEATURE] Config: Add limits to global config
  • [FEATURE] Consul SD: Added support for path_prefix
  • [FEATURE] Native histograms: Add option to scrape both classic and native histograms.
  • [FEATURE] Native histograms: Added support for two more arithmetic operators avg_over_time and sum_over_time
  • [FEATURE] Promtool: When providing the block id, only one block will be loaded and analyzed
  • [FEATURE] Remote-write: New Azure ad configuration to support remote writing directly to Azure Monitor workspace
  • [FEATURE] TSDB: Samples per chunk are now configurable with flag storage.tsdb.samples-per-chunk. By default set to its former value 120
  • [ENHANCEMENT] Native histograms: bucket size can now be limited to avoid scrape fails
  • [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL sooner
  • [BUGFIX] Native histograms: ChunkSeries iterator now checks if a new sample can be appended to the open chunk
  • [BUGFIX] Native histograms: Fix Histogram Appender Appendable() segfault
  • [BUGFIX] Native histograms: Fix setting reset header to gauge histograms in seriesToChunkEncoder
  • [BUGFIX] TSDB: Tombstone intervals are not modified after Get() call
  • [BUGFIX] TSDB: Use path/filepath to set the WAL directory.
• Changes from 2.44.0:
  • [FEATURE] Remote-read: Handle native histograms
  • [FEATURE] Promtool: Health and readiness check of prometheus server in CLI
  • [FEATURE] PromQL: Add query_samples_total metric, the total number of samples loaded by all queries
  • [ENHANCEMENT] Storage: Optimise buffer used to iterate through samples
  • [ENHANCEMENT] Scrape: Reduce memory allocations on target labels
  • [ENHANCEMENT] PromQL: Use faster heap method for topk() / bottomk()
  • [ENHANCEMENT] Rules API: Allow filtering by rule name
  • [ENHANCEMENT] Native Histograms: Various fixes and improvements
  • [ENHANCEMENT] UI: Search of scraping pools is now case-insensitive
  • [ENHANCEMENT] TSDB: Add an affirmative log message for successful WAL repair
  • [BUGFIX] TSDB: Block compaction failed when shutting down
  • [BUGFIX] TSDB: Out-of-order chunks could be ignored if the write-behind log was deleted
• Changes from 2.43.1
  • [BUGFIX] Labels:…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Changes and bugs fixed:
  • Updated to 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Changes from 0.13.1
    • Fix panic caused by missing flagConfig options
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Build using promu
  • Build with Go 1.19
  • Exclude s390 architecture

golang-github-prometheus-prometheus:

• This update introduces breaking changes. Please, read carefully the provided informations.
• Security issues fixed:
  • CVE-2022-41723: Fix uncontrolled resource consumption by updating Go to version 1.20.1 (bsc#1208298)
• Updated to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API: New limit parameter to limit the number of items returned by /api/v1/status/tsdb endpoint
  • [FEATURE] Config: Add limits to global config
  • [FEATURE] Consul SD: Added support for path_prefix
  • [FEATURE] Native histograms: Add option to scrape both classic and native histograms.
  • [FEATURE] Native histograms: Added support for two more arithmetic operators avg_over_time and sum_over_time
  • [FEATURE] Promtool: When providing the block id, only one block will be loaded and analyzed
  • [FEATURE] Remote-write: New Azure ad configuration to support remote writing directly to Azure Monitor workspace
  • [FEATURE] TSDB: Samples per chunk are now configurable with flag storage.tsdb.samples-per-chunk. By default set to its former value 120
  • [ENHANCEMENT] Native histograms: bucket size can now be limited to avoid scrape fails
  • [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL sooner
  • [BUGFIX] Native histograms: ChunkSeries iterator now checks if a new sample can be appended to the open chunk
  • [BUGFIX] Native histograms: Fix Histogram Appender Appendable() segfault
  • [BUGFIX] Native histograms: Fix setting reset header to gauge histograms in seriesToChunkEncoder
  • [BUGFIX] TSDB: Tombstone intervals are not modified after Get() call
  • [BUGFIX] TSDB: Use path/filepath to set the WAL directory.
• Changes from 2.44.0:
  • [FEATURE] Remote-read: Handle native histograms
  • [FEATURE] Promtool: Health and readiness check of prometheus server in CLI
  • [FEATURE] PromQL: Add query_samples_total metric, the total number of samples loaded by all queries
  • [ENHANCEMENT] Storage: Optimise buffer used to iterate through samples
  • [ENHANCEMENT] Scrape: Reduce memory allocations on target labels
  • [ENHANCEMENT] PromQL: Use faster heap method for topk() / bottomk()
  • [ENHANCEMENT] Rules API: Allow filtering by rule name
  • [ENHANCEMENT] Native Histograms: Various fixes and improvements
  • [ENHANCEMENT] UI: Search of scraping pools is now case-insensitive
  • [ENHANCEMENT] TSDB: Add an affirmative log message for successful WAL repair
  • [BUGFIX] TSDB: Block compaction failed when shutting down
  • [BUGFIX] TSDB: Out-of-order chunks could be ignored if the write-behind log was deleted
• Changes from 2.43.1
  • [BUGFIX] Labels: Set() after Del() would be ignored, which broke some relabeling rules
• Changes from 2.43.0:
  • [FEATURE] Promtool: Add HTTP client configuration to query commands
  • [FEATURE] Scrape: Add include_scrape_configs to include scrape configs from different files
  • [FEATURE] HTTP client: Add no_proxy to exclude URLs from proxied requests
  • [FEATURE] HTTP client: Add proxy_from_enviroment to read proxies from env variables
  • [ENHANCEMENT] API: Add support for setting lookback delta per query via the API
  • [ENHANCEMENT] API: Change HTTP status code from 503/422 to 499 if a request is canceled
  • [ENHANCEMENT] Scrape: Allow exemplars for all metric types *…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Changes and bugs fixed:
  • Updated to 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Changes from 0.13.1
    • Fix panic caused by missing flagConfig options
  • Changes from 0.11.0 (jsc#SLE-24791)
    • Add TLS support
    • Switch to logger, please check --log.level and --log.format flags
  • Changes from 0.10.1
    • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
  • Changes from 0.10.0
    • Add Apache Proxy and other metrics
  • Changes from 0.8.0
    • Change commandline flags
    • Add metrics: Apache version, request duration total
  • Changes from 0.7.0
    • Handle OS TERM signals
  • Changes from 0.6.0
    • Add option to override host name
  • Added support for Red Hat Enterprise Linux
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Build using promu
  • Build with Go 1.19
  • Exclude s390 architecture

golang-github-prometheus-node_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

golang-github-QubitProducts-exporter_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

prometheus-postgres_exporter:

• CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server while validating signatures for extremely large RSA keys. (bsc#1213880) There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.

scap-security-guide:

• Updated to 0.1.69 (jsc#ECO-3319)
  • Introduce a JSON build manifest
  • Introduce a script to compare ComplianceAsCode versions
  • Introduce CCN profiles for Red Hat Enterprise Linux 9
  • Map rules to components
  • products/anolis23: supports Anolis OS 23
  • Render components to HTML
  • Store rendered control files
  • Test and use rules to components mapping
  • Use distributed product properties
• Revert patch that breaks the SLE hardening (bsc#1213691)
• Changes from 0.1.68 (jsc#ECO-3319)
  • Bump OL8 STIG version to V1R6
  • Introduce a Product class, make the project work with it
  • Introduce Fedora and Firefox CaC profiles for common workstation users
  • OL7 DISA STIG v2r11 update
  • Publish rendered policy artifacts
  • Update ANSSI BP-028 to version 2.0
• Changes from 0.1.67 (jsc#ECO-3319)
  • Add utils/controlrefcheck.py
  • Red Hat Enterprise Linux 9 STIG Update Q1 2023
  • Include warning for NetworkManager keyfiles in Red Hat Enterprise Linux 9
  • OL7 stig v2r10 update
  • Bump version of OL8 STIG to V1R5
• Various enhancements to SLE profiles

spacecmd:

• Updated to 4.3.23-1
  • Update translation strings

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

ansible:

• Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
  • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
  • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
• Update to 2.9.22:
  • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
  • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)
• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Copy existing wicked config instead of generating new (bsc#1205599)
• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images
• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle
• Require e2fsprogs (bsc#1202614)
• Update to version 0.1.1657643023.0d694ce
  • Update dracut-saltboot dependencies (bsc#1200970)
  • Fix network loading when ipappend is used in pxe config
  • Add new information messages

golang-github-QubitProducts-exporter_exporter:

• Remove license file from %doc
• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Spec file clean up
• Fix apparmor profile for SLE 12
• Do not build with apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build with Go 1.19
• Build using promu
• Add _service file
• Fix sandboxing options
• Upgrade to version 0.13.4
  • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
• Upgrade to version 0.13.3
  • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

• Update to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API:…