CVE-2022-27191

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

• opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

• buildah: possible information disclosure and modification (CVE-2022-2990)

• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
• runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)
• golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)
• podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)
• podman: Remote traffic to rootless containers is seen as orginating from localhost (CVE-2021-20199)
• containers/storage: DoS via malicious image (CVE-2021-20291)
• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
• golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)
• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• containers/storage: DoS via malicious image (CVE-2021-20291)
• golang: net: lookup functions may return invalid host names (CVE-2021-33195)
• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
• podman: possible information disclosure and modification (CVE-2022-2989)
• buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Attackers can cause a crash in SSH servers when the server has been configured by passing a Signer to ServerConfig.AddHostKey such that

1. the Signer passed to AddHostKey does not implement AlgorithmSigner, and
2. the Signer passed to AddHostKey returns a key of type “ssh-rsa” from its PublicKey method.

Servers that only use Signer implementations provided by the ssh package are unaffected.

Information disclosure flaw was found in Buildah (CVE-2021-3602) podman allows forwarding hosts ports to vm from within vm (CVE-2021-4024) Allows use "../" separators in containernetworking/cni to reference binaries such as 'reboot' in network configuration (CVE-2021-20206) github.com/containers/storage ddos via crafted tar file (CVE-2021-20291) buildah improper checking of X.509 certificate (CVE-2021-34558) buildah improper Content-Type checking (CVE-2021-41190) podman privilege escalation (CVE-2022-1227) podman incorrect handling of the supplementary groups (CVE-2022-2989) buildah incorrect handling of the supplementary groups (CVE-2022-2990) skopeo/podman Denial of Service through unbounded cardinality, and potential memory exhaustion (CVE-2022-21698) buildah/podman AddHostKey denail of service (CVE-2022-27191) podman inheritable file capabilities (CVE-2022-27649) buildah inheritable file capabilities (CVE-2022-27651)

This update for coredns fixes the following issues:

Update to version 1.11.3:

• optimize the performance for high qps (#6767)
• bump deps
• Fix zone parser error handling (#6680)
• Add alternate option to forward plugin (#6681)
• fix: plugin/file: return error when parsing the file fails (#6699)
• [fix:documentation] Clarify autopath README (#6750)
• Fix outdated test (#6747)
• Bump go version from 1.21.8 to 1.21.11 (#6755)
• Generate zplugin.go correctly with third-party plugins (#6692)
• dnstap: uses pointer receiver for small response writer (#6644)
• chore: fix function name in comment (#6608)
• [plugin/forward] Strip local zone from IPV6 nameservers (#6635)

• fixes CVE-2023-30464
• fixes CVE-2023-28452

Update to upstream head (git commit #5a52707):

• bump deps to address security issue CVE-2024-22189
• Return RcodeServerFailure when DNS64 has no next plugin (#6590)
• add plusserver to adopters (#6565)
• Change the log flags to be a variable that can be set prior to calling Run (#6546)
• Enable Prometheus native histograms (#6524)
• forward: respect context (#6483)
• add client labels to k8s plugin metadata (#6475)
• fix broken link in webpage (#6488)
• Repo controlled Go version (#6526)
• removed the mutex locks with atomic bool (#6525)

Update to version 1.11.2:

• rewrite: fix multi request concurrency issue in cname rewrite (#6407)
• plugin/tls: respect the path specified by root plugin (#6138)
• plugin/auto: warn when auto is unable to read elements of the directory tree (#6333)
• fix: make the codeowners link relative (#6397)
• plugin/etcd: the etcd client adds the DialKeepAliveTime parameter (#6351)
• plugin/cache: key cache on Checking Disabled (CD) bit (#6354)
• Use the correct root domain name in the proxy plugin's TestHealthX tests (#6395)
• Add PITS Global Data Recovery Services as an adopter (#6304)
• Handle UDP responses that overflow with TC bit with test case (#6277)
• plugin/rewrite: add rcode as a rewrite option (#6204)

• CVE-2024-0874: coredns: CD bit response is cached and served later

• Update to version 1.11.1:

  • Revert “plugin/forward: Continue waiting after receiving malformed responses
  • plugin/dnstap: add support for “extra” field in payload
  • plugin/cache: fix keepttl parsing

• Update to version 1.11.0:

  • Adds support for accepting DNS connections over QUIC (doq).
  • Adds CNAME target rewrites to the rewrite plugin.
  • Plus many bug fixes, and some security improvements.
  • This release introduces the following backward incompatible changes:
  • In the kubernetes plugin, we have dropped support for watching Endpoint and Endpointslice v1beta, since all supported K8s versions now use Endpointslice.
  • The bufsize plugin changed its default size limit value to 1232
  • Some changes to forward plugin metrics.

• Update to version 1.10.1:

  • Corrected architecture labels in multi-arch image manifest
  • A new plugin timeouts that allows configuration of server listener timeout durations
  • acl can drop queries as an action
  • template supports creating responses with extended DNS errors
  • New weighted policy in loadbalance
  • Option to serve original record TTLs from cache

• Update to version 1.10.0:

  • core: add log listeners for k8s_event plugin (#5451)
  • core: log DoH HTTP server error logs in CoreDNS format (#5457)
  • core: warn when domain names are not in RFC1035 preferred syntax (#5414)
  • plugin/acl: add support for extended DNS errors (#5532)
  • plugin/bufsize: do not expand query UDP buffer size if already set to a smaller value (#5602)
  • plugin/cache: add cache disable option (#5540)
  • plugin/cache: add metadata for wildcard record responses (#5308)
  • plugin/cache: add option to adjust SERVFAIL response cache TTL (#5320)
  • plugin/cache: correct responses to Authenticated Data requests (#5191)
  • plugin/dnstap: add identity and version support for the dnstap plugin (#5555) *…

These are all security issues fixed in the podman-4.2.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the coredns-1.10.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerd-1.6.9-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-prometheus-node_exporter-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the velero-1.11.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

prometheus-postgres_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
• Other non-security issues fixed:
  • Adapt the systemd service security configuration to be able to start it on for Red Hat Linux Enterprise systems and clones
  • Add hardening to systemd service(s) (bsc#1181400)
  • Create the prometheus user for Red Hat Linux Enterprise systems and clones
  • Fix broken log-level for values other than debug (bsc#1208965)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version upgrade to 1.5.0:
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0:
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [CHANGE] Default GOMAXPROCS to 1
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds against older macOS SDK
  • [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
  • [ENHANCEMENT] systemd: Expose systemd minor version
  • [ENHANCEMENT] Use netlink for tcpstat collector
  • [ENHANCEMENT] Use netlink to get netdev stats
  • [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
  • [ENHANCEMENT] Add btrfs device error stats

This update for containerd, docker fixes the following issues:

• CVE-2022-24769: Fixed incorrect default inheritable capabilities (bsc#1197517).
• CVE-2022-23648: Fixed directory traversal issue (bsc#1196441).
• CVE-2021-41190: Fixed parsing confusions in OCI manifest and index (bsc#1193273).
• CVE-2022-27191: Fixed a crash in a golang.org/x/crypto/ssh server (bsc#1197284).
• CVE-2021-43565: Fixed a panic in golang.org/x/crypto by empty plaintext packet (bsc#1193930).

This update for containerd, docker fixes the following issues:

• CVE-2022-24769: Fixed incorrect default inheritable capabilities (bsc#1197517).
• CVE-2022-23648: Fixed directory traversal issue (bsc#1196441).
• CVE-2022-27191: Fixed a crash in a golang.org/x/crypto/ssh server (bsc#1197284).
• CVE-2021-43565: Fixed a panic in golang.org/x/crypto by empty plaintext packet (bsc#1193930).

This update for podman fixes the following issues:

Updated to version 3.4.7:

• CVE-2022-1227: Fixed an issue that could allow an attacker to publish a malicious image to a public registry and run arbitrary code in the victim's context via the 'podman top' command (bsc#1182428).
• CVE-2022-27191: Fixed a potential crash via SSH under specific configurations (bsc#1197284).
• CVE-2022-21698: Fixed a potential denial of service that affected servers that used Prometheus instrumentation (bsc#1196338).

This update for podman fixes the following issues:

Updated to version 3.4.7:

• CVE-2022-1227: Fixed an issue that could allow an attacker to publish a malicious image to a public registry and run arbitrary code in the victim's context via the 'podman top' command (bsc#1182428).
• CVE-2022-27191: Fixed a potential crash via SSH under specific configurations (bsc#1197284).
• CVE-2022-21698: Fixed a potential denial of service that affected servers that used Prometheus instrumentation (bsc#1196338).

This update for podman fixes the following issues:

Updated to version 3.4.7:

• CVE-2022-1227: Fixed an issue that could allow an attacker to publish a malicious image to a public registry and run arbitrary code in the victim's context via the 'podman top' command (bsc#1182428).
• CVE-2022-27191: Fixed a potential crash via SSH under specific configurations (bsc#1197284).
• CVE-2022-21698: Fixed a potential denial of service that affected servers that used Prometheus instrumentation (bsc#1196338).

This update for containerd fixes the following issues:

Update to containerd v1.6.12 including Docker v20.10.21-ce (bsc#1206065).

Also includes the following fix:

• CVE-2022-23471: host memory exhaustion through Terminal resize goroutine leak (bsc#1206235).
• CVE-2022-27191: crash in a golang.org/x/crypto/ssh server (bsc#1197284).

This update for containerd fixes the following issues:

Update to containerd v1.6.12 including Docker v20.10.21-ce (bsc#1206065).

Also includes the following fix:

• CVE-2022-23471: host memory exhaustion through Terminal resize goroutine leak (bsc#1206235).
• CVE-2022-27191: crash in a golang.org/x/crypto/ssh server (bsc#1197284).

This update fixes the following issues:

golang-github-prometheus-alertmanager:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)

prometheus-blackbox_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208062)
• Other non-security bugs fixed and changes:
  • Add min_version parameter of tls_config to allow enabling TLS 1.0 and 1.1 (bsc#1209113)
  • On SUSE Linux Enterprise build always with Go >= 1.19 (bsc#1203599)

prometheus-postgres_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
• Other non-security issues fixed:
  • Adapt the systemd service security configuration to be able to start it on for Red Hat Linux Enterprise systems and clones
  • Create the prometheus user for Red Hat Linux Enterprise systems and clones
  • Fix broken log-level for values other than debug (bsc#1208965)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [BUGFIX] Handle nil CPU thermal power status on M1
  • [BUGFIX] bsd: Ignore filesystems flagged as MNT_IGNORE
  • [BUGFIX] Sanitize UTF-8 in dmi collector
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds…

This update fixes the following issues:

prometheus-postgres_exporter:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
• Other non-security issues fixed:
  • Adapt the systemd service security configuration to be able to start it on for Red Hat Linux Enterprise systems and clones
  • Add hardening to systemd service(s) (bsc#1181400)
  • Create the prometheus user for Red Hat Linux Enterprise systems and clones
  • Fix broken log-level for values other than debug (bsc#1208965)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version upgrade to 1.5.0:
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0:
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [CHANGE] Default GOMAXPROCS to 1
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds against older macOS SDK
  • [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
  • [ENHANCEMENT] systemd: Expose systemd minor version
  • [ENHANCEMENT] Use netlink for tcpstat collector
  • [ENHANCEMENT] Use netlink to get netdev stats
  • [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
  • [ENHANCEMENT] Add btrfs device error stats

This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:

golang-github-prometheus-alertmanager:

• Security issues fixed:
  • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
  • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
  • CVE-2022-27664: Update go/x/net (bsc#1203185)
  • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):
  • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
  • [BUGFIX] Fix hwmon label sanitizer
  • [BUGFIX] Use native endianness when encoding InetDiagMsg
  • [BUGFIX] Fix btrfs device stats always being zero
  • [BUGFIX] Fix diskstats exclude flags
  • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
  • [BUGFIX] Fix concurrency issue in ethtool collector
  • [BUGFIX] Fix concurrency issue in netdev collector
  • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
  • [BUGFIX] Fix iostat on macos broken by deprecation warning
  • [BUGFIX] Fix NodeFileDescriptorLimit alerts
  • [BUGFIX] Sanitize rapl zone names
  • [BUGFIX] Add file descriptor close safely in test
  • [BUGFIX] Fix race condition in os_release.go
  • [BUGFIX] Skip ZFS IO metrics if their paths are missing
  • [BUGFIX] Handle nil CPU thermal power status on M1
  • [BUGFIX] bsd: Ignore filesystems flagged as MNT_IGNORE
  • [BUGFIX] Sanitize UTF-8 in dmi collector
  • [CHANGE] Merge metrics descriptions in textfile collector
  • [FEATURE] Add multiple listeners and systemd socket listener activation
  • [FEATURE] [node-mixin] Add darwin dashboard to mixin
  • [FEATURE] Add 'isolated' metric on cpu collector on linux
  • [FEATURE] Add cgroup summary collector
  • [FEATURE] Add selinux collector
  • [FEATURE] Add slab info collector
  • [FEATURE] Add sysctl collector
  • [FEATURE] Also track the CPU Spin time for OpenBSD systems
  • [FEATURE] Add support for MacOS version
  • [ENHANCEMENT] Add RTNL version of netclass collector
  • [ENHANCEMENT] [node-mixin] Add missing selectors
  • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
  • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
  • [ENHANCEMENT] [node-mixin] Change io time units to %util
  • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
  • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
  • [ENHANCEMENT] Add device filter flags to arp collector
  • [ENHANCEMENT] Add diskstats include and exclude device flags
  • [ENHANCEMENT] Add node_softirqs_total metric
  • [ENHANCEMENT] Add rapl zone name label option
  • [ENHANCEMENT] Add slabinfo collector
  • [ENHANCEMENT] Allow user to select port on NTP server to query
  • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
  • [ENHANCEMENT] Enable builds against older macOS SDK
  • [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
  • [ENHANCEMENT] systemd: Expose systemd minor version
  • [ENHANCEMENT] Use netlink for tcpstat collector
  • [ENHANCEMENT] Use netlink to get netdev stats
  • [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
  • [ENHANCEMENT] Add btrfs device error stats
• Change build requirement to go1.18 or higher (previously this was fixed to version 1.14)

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update for docker-stable fixes the following issues:

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. (bsc#1250596)

• Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Backport https://github.com/moby/moby/pull/48517. bsc#1247362

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.

This update for docker-stable fixes the following issues:

Note this update contains a already fixed references mostly.

• Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. bsc#1250596

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Update to Go 1.23 for building now that upstream has switched their 23.0.x LTSS to use Go 1.23.

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.