CVE-2020-12245

Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (6.7.4). (BZ#1807323)

Security Fix(es):

• grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen (CVE-2018-18624)

• grafana: arbitrary file read via MySQL data source (CVE-2019-19499)

• grafana: stored XSS (CVE-2020-11110)

• grafana: XSS annotation popup vulnerability (CVE-2020-12052)

• grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)

• grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)

• grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)

• grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

Grafana XSS in header column rename in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v6.7.3.

This update for grafana, grafana-piechart-panel, grafana-status-panel fixes the following issues:

grafana was updated to version 7.0.3:

• Features / Enhancements

  • Stats: include all fields. #24829, @ryantxu
  • Variables: change VariableEditorList row action Icon to IconButton. #25217, @hshoff

• Bug fixes

  • Cloudwatch: Fix dimensions of DDoSProtection. #25317, @papagian
  • Configuration: Fix env var override of sections containing hyphen. #25178, @marefr
  • Dashboard: Get panels in collapsed rows. #25079, @peterholmberg
  • Do not show alerts tab when alerting is disabled. #25285, @dprokop
  • Jaeger: fixes cascader option label duration value. #25129, @Estrax
  • Transformations: Fixed Transform tab crash & no update after adding first transform. #25152, @torkelo

Update to version 7.0.2

• Bug fixes

  • Security: Urgent security patch release to fix CVE-2020-13379

Update to version 7.0.1

• Features / Enhancements

  • Datasource/CloudWatch: Makes CloudWatch Logs query history more readable. #24795, @kaydelaney
  • Download CSV: Add date and time formatting. #24992, @ryantxu
  • Table: Make last cell value visible when right aligned. #24921, @peterholmberg
  • TablePanel: Adding sort order persistance. #24705, @torkelo
  • Transformations: Display correct field name when using reduce transformation. #25068, @peterholmberg
  • Transformations: Allow custom number input for binary operations. #24752, @ryantxu

• Bug fixes

  • Dashboard/Links: Fixes dashboard links by tags not working. #24773, @KamalGalrani
  • Dashboard/Links: Fixes open in new window for dashboard link. #24772, @KamalGalrani
  • Dashboard/Links: Variables are resolved and limits to 100. #25076, @hugohaggmark
  • DataLinks: Bring back variables interpolation in title. #24970, @dprokop
  • Datasource/CloudWatch: Field suggestions no longer limited to prefix-only. #24855, @kaydelaney
  • Explore/Table: Keep existing field types if possible. #24944, @kaydelaney
  • Explore: Fix wrap lines toggle for results of queries with filter expression. #24915, @ivanahuckova
  • Explore: fix undo in query editor. #24797, @zoltanbedi
  • Explore: fix word break in type head info. #25014, @zoltanbedi
  • Graph: Legend decimals now work as expected. #24931, @torkelo
  • LoginPage: Fix hover color for service buttons. #25009, @tskarhed
  • LogsPanel: Fix scrollbar. #24850, @ivanahuckova
  • MoveDashboard: Fix for moving dashboard caused all variables to be lost. #25005, @torkelo
  • Organize transformer: Use display name in field order comparer. #24984, @dprokop
  • Panel: shows correct panel menu items in view mode. #24912, @hugohaggmark
  • PanelEditor Fix missing labels and description if there is only single option in category. #24905, @dprokop
  • PanelEditor: Overrides name matcher still show all original field names even after Field default display name is specified. #24933, @torkelo
  • PanelInspector: Makes sure Data display options are visible. #24902, @hugohaggmark
  • PanelInspector: Hides unsupported data display options for Panel type. #24918, @hugohaggmark
  • PanelMenu: Make menu disappear on button press. #25015, @tskarhed
  • Postgres: Fix add button. #25087, @phemmer
  • Prometheus: Fix recording rules expansion. #24977, @ivanahuckova
  • Stackdriver: Fix creating Service Level Objectives (SLO) datasource query variable. #25023, @papagian

Update to version 7.0.0

• Breaking changes

  • Removed PhantomJS: PhantomJS was deprecated in Grafana v6.4 and starting from Grafana v7.0.0, all PhantomJS support has been removed. This means that Grafana no longer ships with a built-in image renderer, and we advise you to install the Grafana Image Renderer plugin.
  • Dashboard: A global minimum dashboard refresh interval is now enforced and defaults to 5 seconds.
  • Interval calculation: There is now a new option Max data points that controls the auto interval $__interval calculation. Interval was previously calculated by dividing the panel width by the…

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
    • TSDB: Export metric for WAL write errors #6647
    • TSDB: Improve query performance for queries that only touch…

This update for grafana fixes the following issues:

grafana was updated to version 7.1.5:

• Features / Enhancements

  • Stats: Stop counting the same user multiple times.
  • Field overrides: Filter by field name using regex.
  • AzureMonitor: map more units.
  • Explore: Don't run queries on datasource change.
  • Graph: Support setting field unit & override data source (automatic) unit.
  • Explore: Unification of logs/metrics/traces user interface
  • Table: JSON Cell should try to convert strings to JSON
  • Variables: enables cancel for slow query variables queries.
  • TimeZone: unify the time zone pickers to one that can rule them all.
  • Search: support URL query params.
  • Grafana-UI: Add FileUpload.
  • TablePanel: Sort numbers correctly.

• Bug fixes

  • Alerting: remove LongToWide call in alerting.
  • AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used.
  • Variables: Fixes issue with All variable not being resolved.
  • Templating: Fixes so texts show in picker not the values.
  • Templating: Templating: Fix undefined result when using raw interpolation format
  • TextPanel: Fix content overflowing panel boundaries.
  • StatPanel: Fix stat panel display name not showing when explicitly set.
  • Query history: Fix search filtering if null value.
  • Flux: Ensure connections to InfluxDB are closed.
  • Dashboard: Fix for viewer can enter panel edit mode by modifying url (but cannot not save anything).
  • Prometheus: Fix prom links in mixed mode.
  • Sign In Use correct url for the Sign In button.
  • StatPanel: Fixes issue with name showing for single series / field results
  • BarGauge: Fix space bug in single series mode.
  • Auth: Fix POST request failures with anonymous access
  • Templating: Fix recursive loop of template variable queries when changing ad-hoc-variable
  • Templating: Fixed recursive queries triggered when switching dashboard settings view
  • GraphPanel: Fix annotations overflowing panels.
  • Prometheus: Fix performance issue in processing of histogram labels.
  • Datasources: Handle URL parsing error.
  • Security: Use Header.Set and Header.Del for X-Grafana-User header.

This update for grafana fixes the following issues:

Update to version 7.1.5:

• Features / Enhancements

  • Stats: Stop counting the same user multiple times.
  • Field overrides: Filter by field name using regex.
  • AzureMonitor: map more units.
  • Explore: Don't run queries on datasource change.
  • Graph: Support setting field unit & override data source (automatic) unit.
  • Explore: Unification of logs/metrics/traces user interface
  • Table: JSON Cell should try to convert strings to JSON
  • Variables: enables cancel for slow query variables queries.
  • TimeZone: unify the time zone pickers to one that can rule them all.
  • Search: support URL query params.
  • Grafana-UI: Add FileUpload.
  • TablePanel: Sort numbers correctly.

• Bug fixes

  • Alerting: remove LongToWide call in alerting.
  • AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used.
  • Variables: Fixes issue with All variable not being resolved.
  • Templating: Fixes so texts show in picker not the values.
  • Templating: Templating: Fix undefined result when using raw interpolation format
  • TextPanel: Fix content overflowing panel boundaries.
  • StatPanel: Fix stat panel display name not showing when explicitly set.
  • Query history: Fix search filtering if null value.
  • Flux: Ensure connections to InfluxDB are closed.
  • Dashboard: Fix for viewer can enter panel edit mode by modifying url (but cannot not save anything).
  • Prometheus: Fix prom links in mixed mode.
  • Sign In Use correct url for the Sign In button.
  • StatPanel: Fixes issue with name showing for single series / field results
  • BarGauge: Fix space bug in single series mode.
  • Auth: Fix POST request failures with anonymous access
  • Templating: Fix recursive loop of template variable queries when changing ad-hoc-variable
  • Templating: Fixed recursive queries triggered when switching dashboard settings view
  • GraphPanel: Fix annotations overflowing panels.
  • Prometheus: Fix performance issue in processing of histogram labels.
  • Datasources: Handle URL parsing error.
  • Security: Use Header.Set and Header.Del for X-Grafana-User header.

Update to version 7.0.3

• Features / Enhancements

  • Stats: include all fields. #24829, @ryantxu
  • Variables: change VariableEditorList row action Icon to IconButton. #25217, @hshoff

• Bug fixes

  • Cloudwatch: Fix dimensions of DDoSProtection. #25317, @papagian
  • Configuration: Fix env var override of sections containing hyphen. #25178, @marefr
  • Dashboard: Get panels in collapsed rows. #25079, @peterholmberg
  • Do not show alerts tab when alerting is disabled. #25285, @dprokop
  • Jaeger: fixes cascader option label duration value. #25129, @Estrax
  • Transformations: Fixed Transform tab crash & no update after adding first transform. #25152, @torkelo

Update to version 7.0.2

• Bug fixes
  • Security: Urgent security patch release to fix CVE-2020-13379

Update to version 7.0.1

• Features / Enhancements

  • Datasource/CloudWatch: Makes CloudWatch Logs query history more readable. #24795, @kaydelaney
  • Download CSV: Add date and time formatting. #24992, @ryantxu
  • Table: Make last cell value visible when right aligned. #24921, @peterholmberg
  • TablePanel: Adding sort order persistance. #24705, @torkelo
  • Transformations: Display correct field name when using reduce transformation. #25068, @peterholmberg
  • Transformations: Allow custom number input for binary operations. #24752, @ryantxu

• Bug fixes

  • Dashboard/Links: Fixes dashboard links by tags not working. #24773, @KamalGalrani
  • Dashboard/Links: Fixes open in new window for dashboard link. #24772, @KamalGalrani
  • Dashboard/Links: Variables are resolved and limits to 100. #25076, @hugohaggmark
  • DataLinks: Bring back variables interpolation in title. #24970, @dprokop
  • Datasource/CloudWatch: Field suggestions no longer limited to prefix-only. #24855, @kaydelaney -…

These are all security issues fixed in the grafana-7.5.7-1.2 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules
• Add missing terminal naming modifiers as exported veriables

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543 …

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and…

This update fixes the following issues:

cobbler:

• Calculate relative path for kernel and inited when generating grub entry (bsc#1170231) Added: fix-grub2-entry-paths.diff
• Fix os-release version detection for SUSE Modified: sles15.patch
• Jinja2 template library fix (bsc#1141661)
• Removes string replace for textmode fix (bsc#1134195)

golang-github-prometheus-node_exporter:

• Update to 0.18.1
  • [BUGFIX] Fix incorrect sysctl call in BSD meminfo collector, resulting in broken swap metrics on FreeBSD #1345
  • [BUGFIX] Fix rollover bug in mountstats collector #1364
  • Renamed interface label to device in netclass collector for consistency with
  • other network metrics #1224
  • The cpufreq metrics now separate the cpufreq and scaling data based on what the driver provides. #1248
  • The labels for the network_up metric have changed, see issue #1236
  • Bonding collector now uses mii_status instead of operstatus #1124
  • Several systemd metrics have been turned off by default to improve performance #1254
  • These include unit_tasks_current, unit_tasks_max, service_restart_total, and unit_start_time_seconds
  • The systemd collector blacklist now includes automount, device, mount, and slice units by default. #1255
  • [CHANGE] Bonding state uses mii_status #1124
  • [CHANGE] Add a limit to the number of in-flight requests #1166
  • [CHANGE] Renamed interface label to device in netclass collector #1224
  • [CHANGE] Add separate cpufreq and scaling metrics #1248
  • [CHANGE] Several systemd metrics have been turned off by default to improve performance #1254
  • [CHANGE] Expand systemd collector blacklist #1255
  • [CHANGE] Split cpufreq metrics into a separate collector #1253
  • [FEATURE] Add a flag to disable exporter metrics #1148
  • [FEATURE] Add kstat-based Solaris metrics for boottime, cpu and zfs collectors #1197
  • [FEATURE] Add uname collector for FreeBSD #1239
  • [FEATURE] Add diskstats collector for OpenBSD #1250
  • [FEATURE] Add pressure collector exposing pressure stall information for Linux #1174
  • [FEATURE] Add perf exporter for Linux #1274
  • [ENHANCEMENT] Add Infiniband counters #1120
  • [ENHANCEMENT] Add TCPSynRetrans to netstat default filter #1143
  • [ENHANCEMENT] Move network_up labels into new metric network_info #1236
  • [ENHANCEMENT] Use 64-bit counters for Darwin netstat
  • [BUGFIX] Add fallback for missing /proc/1/mounts #1172
  • [BUGFIX] Fix node_textfile_mtime_seconds to work properly on symlinks #1326
• Add network-online (Wants and After) dependency to systemd unit bsc#1143913

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
  • Changed:
    • 0002-Default-settings.patch Changed
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug…

This update fixes the following issues:

dracut-saltboot:

• Print a list of available disk devices (bsc#1170824)
• Install wipefs to initrd
• Force install crypt modules

golang-github-prometheus-prometheus:

• Update change log and spec file
  • Modified spec file: default to golang 1.14 to avoid 'have choice' build issues in OBS.
  • Rebase and update patches for version 2.18.0
• Update to 2.18.0
  • Features
    • Tracing: Added experimental Jaeger support #7148
  • Changes
    • Federation: Only use local TSDB for federation (ignore remote read). #7096
    • Rules: rule_evaluations_total and rule_evaluation_failures_total have a rule_group label now. #7094
  • Enhancements
    • TSDB: Significantly reduce WAL size kept around after a block cut. #7098
    • Discovery: Add architecture meta label for EC2. #7000
  • Bug fixes
    • UI: Fixed wrong MinTime reported by /status. #7182
    • React UI: Fixed multiselect legend on OSX. #6880
    • Remote Write: Fixed blocked resharding edge case. #7122
    • Remote Write: Fixed remote write not updating on relabel configs change. #7073
• Changes from 2.17.2
  • Bug fixes
    • Federation: Register federation metrics #7081
    • PromQL: Fix panic in parser error handling #7132
    • Rules: Fix reloads hanging when deleting a rule group that is being evaluated #7138
    • TSDB: Fix a memory leak when prometheus starts with an empty TSDB WAL #7135
    • TSDB: Make isolation more robust to panics in web handlers #7129 #7136
• Changes from 2.17.1
  • Bug fixes
    • TSDB: Fix query performance regression that increased memory and CPU usage #7051
• Changes from 2.17.0
  • Features
    • TSDB: Support isolation #6841
    • This release implements isolation in TSDB. API queries and recording rules are guaranteed to only see full scrapes and full recording rules. This comes with a certain overhead in resource usage. Depending on the situation, there might be some increase in memory usage, CPU usage, or query latency.
  • Enhancements
    • PromQL: Allow more keywords as metric names #6933
    • React UI: Add normalization of localhost URLs in targets page #6794
    • Remote read: Read from remote storage concurrently #6770
    • Rules: Mark deleted rule series as stale after a reload #6745
    • Scrape: Log scrape append failures as debug rather than warn #6852
    • TSDB: Improve query performance for queries that partially hit the head #6676
    • Consul SD: Expose service health as meta label #5313
    • EC2 SD: Expose EC2 instance lifecycle as meta label #6914
    • Kubernetes SD: Expose service type as meta label for K8s service role #6684
    • Kubernetes SD: Expose label_selector and field_selector #6807
    • Openstack SD: Expose hypervisor id as meta label #6962
  • Bug fixes
    • PromQL: Do not escape HTML-like chars in query log #6834 #6795
    • React UI: Fix data table matrix values #6896
    • React UI: Fix new targets page not loading when using non-ASCII characters #6892
    • Remote read: Fix duplication of metrics read from remote storage with external labels #6967 #7018
    • Remote write: Register WAL watcher and live reader metrics for all remotes, not just the first one #6998
    • Scrape: Prevent removal of metric names upon relabeling #6891
    • Scrape: Fix 'superfluous response.WriteHeader call' errors when scrape fails under some circonstances #6986
    • Scrape: Fix crash when reloads are separated by two scrape intervals #7011
• Changes from 2.16.0
  • Features
    • React UI: Support local timezone on /graph #6692
    • PromQL: add absent_over_time query function #6490
    • Adding optional logging of queries to their own file #6520
  • Enhancements
    • React UI: Add support for rules page and 'Xs ago' duration displays #6503
    • React UI: alerts page, replace filtering togglers tabs with checkboxes #6543
    • TSDB: Export metric for WAL write errors #6647
    • TSDB: Improve query performance for queries that only touch…

This update for grafana and system-user-grafana fixes the following issues:

• Updated grafana to upstream version 7.3.1

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana

  • CVE-2020-12245: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip (bsc#1170557)

  • CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault (bsc#1172409)

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana (bsc#1148383)

  • CVE-2020-12052: Grafana version below 6.7.3 is vulnerable for annotation popup XSS (bsc#1170657)

  • CVE-2020-24303: Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. (bsc#1178243)

  • CVE-2018-18623: Grafana 5.3.1 has XSS via the 'Dashboard > Text Panel' screen (bsc#1172450)

  • CVE-2019-19499: Grafana versions below or equal to 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations (bsc#1175951)

  • Please refer to this package's changelog to get a full list of all changes (including bug fixes etc.)

• Initial shipment of system-user-grafana to SES 6