CVE-2021-3711

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).(CVE-2021-3711)

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).(CVE-2021-3712)

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter.

A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small.

A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated.

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).

• CVE-2021-3711: Fix an incorrect buffer size calculation leads to an overflow
• Check the plaintext buffer is large enough when decrypting SM2
• Add extended tests for SM2

• CVE-2021-3711: Fix an incorrect buffer size calculation leads to an overflow
• Check the plaintext buffer is large enough when decrypting SM2
• Add extended tests for SM2

• CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer is large enough when decrypting SM2; add extended tests for SM2
• CVE-2022-3996: fix X.509 policy constraints double-locking denial of service
• CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints
• CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check
• CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates
• CVE-2024-13176: fix timing side-channel in ECDSA signature computation
• CVE-2024-5535: validate provided client list in SSL_select_next_proto
• CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap
• CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion
• CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()
• CVE-2026-28387: fix use-after-free / double-free in dane_match()
• CVE-2026-28388: fix NULL dereference in check_delta_base()
• CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()
• CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()

• CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer is large enough when decrypting SM2; add extended tests for SM2
• CVE-2022-3996: fix X.509 policy constraints double-locking denial of service
• CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints
• CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check
• CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates
• CVE-2024-13176: fix timing side-channel in ECDSA signature computation
• CVE-2024-5535: validate provided client list in SSL_select_next_proto
• CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap
• CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion
• CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()
• CVE-2026-28387: fix use-after-free / double-free in dane_match()
• CVE-2026-28388: fix NULL dereference in check_delta_base()
• CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()
• CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()

• CVE-2021-3711: fix SM2 decryption buffer overflow; check the plaintext buffer is large enough when decrypting SM2; add extended tests for SM2
• CVE-2022-3996: fix X.509 policy constraints double-locking denial of service
• CVE-2023-0464: fix excessive resource use verifying X.509 policy constraints
• CVE-2023-0466: fix X509_VERIFY_PARAM_add0_policy() does not enable policy check
• CVE-2023-2650: restrict the size of OBJECT IDENTIFIERs that OBJ_obj2txt translates
• CVE-2024-13176: fix timing side-channel in ECDSA signature computation
• CVE-2024-5535: validate provided client list in SSL_select_next_proto
• CVE-2025-9230: fix out-of-bounds read and write in RFC 3211 KEK unwrap
• CVE-2025-69419: fix one-byte write-before-buffer in PKCS#12 BMPString conversion
• CVE-2025-69421: fix NULL dereference in PKCS12_item_decrypt_d2i_ex()
• CVE-2026-28387: fix use-after-free / double-free in dane_match()
• CVE-2026-28388: fix NULL dereference in check_delta_base()
• CVE-2026-28389: fix NULL dereference in dh/ecdh_cms_set_shared_info()
• CVE-2026-28390: fix NULL dereference in rsa_cms_decrypt()

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. (CVE-2021-3711)

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). (CVE-2021-3712)

Buffer overflow due to inccorect calculation in EVP_PKEY_decrypt. (CVE-2021-3711) Denial of Service attack due to possible non-zero terminated strings. (CVE-2021-3712)

This update for openssl-1_1 fixes the following security issues:

• CVE-2021-3711: A bug in the implementation of the SM2 decryption code could lead to buffer overflows. [bsc#1189520]

• CVE-2021-3712: a bug in the code for printing certificate details could lead to a buffer overrun that a malicious actor could exploit to crash the application, causing a denial-of-service attack. [bsc#1189521]

This update was imported from the SUSE:SLE-15-SP2:Update update project.

This update for openssl-1_1 fixes the following security issues:

• CVE-2021-3711: A bug in the implementation of the SM2 decryption code could lead to buffer overflows. [bsc#1189520]

• CVE-2021-3712: a bug in the code for printing certificate details could lead to a buffer overrun that a malicious actor could exploit to crash the application, causing a denial-of-service attack. [bsc#1189521]

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grafana-8.3.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the grype-0.92.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23422)

• Security:

  • CVE-2022-21702: XSS vulnerability in handling data sources (bsc#1195726)
  • CVE-2022-21703: cross-origin request forgery vulnerability (bsc#1195727)
  • CVE-2022-21713: Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728)
  • CVE-2022-21673: GetUserInfo: return an error if no user was found (bsc#1194873)
  • CVE-2021-43813, CVE-2021-43815, CVE-2021-41244, CVE-2021-41174, CVE-2021-43798, CVE-2021-39226.
  • Upgrade Docker base image to Alpine 3.14.3.
  • CVE-2021-3711: Docker: Force use of libcrypto1.1 and libssl1.1 versions
  • Update dependencies to fix CVE-2021-36222.
  • Upgrade Go to 1.17.2.
  • Fix stylesheet injection vulnerability.
  • Fix short URL vulnerability.

• License update:

  • AGPL License: Update license from Apache 2.0 to the GNU Affero General Public License (AGPL).

• Breaking changes:

  • Grafana 8 Alerting enabled by default for installations that do not use legacy alerting.
  • Keep Last State for 'If execution error or timeout' when upgrading to Grafana 8 alerting.
  • Fix No Data behaviour in Legacy Alerting.
  • The following endpoints were deprecated for Grafana v5.0 and support for them has now been removed:
    • GET /dashboards/db/:slug
    • GET /dashboard-solo/db/:slug
    • GET /api/dashboard/db/:slug
    • DELETE /api/dashboards/db/:slug
  • The default HTTP method for Prometheus data source is now POST.
  • Removes the never refresh option for Query variables.
  • Removes the experimental Tags feature for Variables.

• Deprecations:

  • The InfoBox & FeatureInfoBox are now deprecated please use the Alert component instead with severity info.

• Bug fixes:

  • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
  • Azure Monitor: Improved error messages for variable queries.
  • CloudMonitoring: Fixes broken variable queries that use group bys.
  • Configuration: You can now see your expired API keys if you have no active ones.
  • Elasticsearch: Fix handling multiple datalinks for a single field.
  • Export: Fix error when exporting dashboards using query variables that reference the default datasource.
  • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
  • Login: Page no longer overflows on mobile.
  • Plugins: Set backend metadata property for core plugins.
  • Prometheus: Fill missing steps with null values.
  • Prometheus: Fix interpolation of $__rate_interval variable.
  • Prometheus: Interpolate variables with curly brackets syntax.
  • Prometheus: Respect the http-method data source setting.
  • Table: Fixes issue with field config applied to wrong fields when hiding columns.
  • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
  • Variables: Fix so data source variables are added to adhoc configuration.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix…

This update for openssl-1_1 fixes the following security issues:

• CVE-2021-3711: A bug in the implementation of the SM2 decryption code could lead to buffer overflows. [bsc#1189520]

• CVE-2021-3712: a bug in the code for printing certificate details could lead to a buffer overrun that a malicious actor could exploit to crash the application, causing a denial-of-service attack. [bsc#1189521]

This update for openssl-1_1 fixes the following security issues:

• CVE-2021-3711: A bug in the implementation of the SM2 decryption code could lead to buffer overflows. [bsc#1189520]

• CVE-2021-3712: a bug in the code for printing certificate details could lead to a buffer overrun that a malicious actor could exploit to crash the application, causing a denial-of-service attack. [bsc#1189521]

This security update fixes the following issues:

golang-github-prometheus-prometheus:

• Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  • Bugfixes:
    • Scrape: Fix reporting metrics when sample limit is reached during the report. #9996
    • Scrape: Ensure that scrape interval and scrape timeout are always set. #10023
    • TSDB: Expose and fix bug in iterators' Seek() method. #10030
• Upgrade to upstream version 2.32.0
  • Change:
    • remote-write: Change default max retry time from 100ms to 5 seconds. #9634
  • Features:
    • Agent: New mode of operation optimized for remote-write only scenarios, without local storage.
    • Promtool: Add promtool check service-discovery command. #8970
  • Enhancements:
    • Promtool: Improve test output. #8064
    • Promtool: Use kahan summation for better numerical stability.
    • Remote-write: Reuse memory for marshalling. #9412
    • Scrape: Add scrape_body_size_bytes scrape metric behind the --enable-feature=extra-scrape-metrics flag. #9569
    • TSDB: Add windows arm64 support. #9703
    • TSDB: Optimize query by skipping unneeded sorting in TSDB.
    • Templates: Support int and uint as datatypes for template formatting. #9680
    • UI: Prefer rate over rad, delta over deg, and count over cos in autocomplete. #9688
    • TSDB: Add more size checks when writing individual sections in the index. #9710
    • PromQL: Make deriv() return zero values for constant series.
    • TSDB: Fix panic when checkpoint directory is empty. #9687
    • TSDB: Fix panic, out of order chunks, and race warning during WAL replay. #9856
    • UI: Correctly render links for targets with IPv6 addresses that contain a Zone ID. #9853
    • Promtool: Fix checking of authorization.credentials_file and bearer_token_file fields. #9883
    • Uyuni SD: Fix null pointer exception during initialization.
    • TSDB: Fix queries after a failed snapshot replay. #9980
• Upgrade to upstream version 2.31.1
  • Bugfix:
    • SD: Fix a panic when the experimental discovery manager receives targets during a reload. #9656
• Upgrade to upstream version 2.31.0
  • UI: Remove standard PromQL editor in favour of the codemirror-based editor. #9452
  • PromQL: Add trigonometric functions and atan2 binary operator. #9239 #9248 #9515
  • Remote: Add support for exemplar in the remote write receiver endpoint. #9319 #9414
  • SD: Add PuppetDB service discovery. #8883
  • SD: Add Uyuni service discovery. #8190
  • Web: Add support for security-related HTTP headers. #9546
  • Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  • Backfill: Add --max-block-duration in promtool create-blocks-from rules. #9511
  • Config: Print human-readable sizes with unit instead of raw numbers. #9361
  • HTTP: Re-enable HTTP/2. #9398
  • Kubernetes SD: Warn user if number of endpoints exceeds limit. #9467
  • OAuth2: Add TLS configuration to token requests. #9550
  • PromQL: Several optimizations. #9365 #9360 #9362 #9552
  • PromQL: Make aggregations deterministic in instant queries.
  • Rules: Add the ability to limit number of alerts or series.
  • SD: Experimental discovery manager to avoid restarts upon reload.
  • UI: Debounce timerange setting changes. #9359
  • Backfill: Apply rule labels after query labels. #9421
  • Scrape: Resolve conflicts between multiple exported label prefixes. #9479 #9518
  • Scrape: Restart scrape loops when scrape_interval is changed. #9551
  • TSDB: Fix memory leak in samples deletion. #9151
  • UI: Use consistent margin-bottom for all alert kinds. #9318
• Upgrade to upstream version 2.30.3
  • TSDB: Fix panic on failed snapshot replay. #9438
  • TSDB: Don't fail snapshot replay with exemplar storage disabled when the snapshot contains exemplars. #9438
• Upgrade to upstream version 2.30.2
  • TSDB: Don't error on…

This update fixes the following issues:

grafana:

• Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422)
  • Security:
    • Fixes XSS vulnerability in handling data sources (bsc#1195726, CVE-2022-21702)
    • Fixes cross-origin request forgery vulnerability (bsc#1195727, CVE-2022-21703)
    • Fixes Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728, CVE-2022-21713)
• Update to Go 1.17.
• Add build-time dependency on wire.
• Update license to GNU Affero General Public License v3.0.
• Update to version 8.3.4
  • GetUserInfo: return an error if no user was found (bsc#1194873, CVE-2022-21673)
  • Features and enhancements:
    • Alerting: Allow configuration of non-ready alertmanagers.
    • Alerting: Allow customization of Google chat message.
    • AppPlugins: Support app plugins with only default nav.
    • InfluxDB: query editor: skip fields in metadata queries.
    • Postgres/MySQL/MSSQL: Cancel in-flight SQL query if user cancels query in grafana.
    • Prometheus: Forward oauth tokens after prometheus datasource migration.
  • Bug fixes:
    • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
    • Azure Monitor: Improved error messages for variable queries.
    • CloudMonitoring: Fixes broken variable queries that use group bys.
    • Configuration: You can now see your expired API keys if you have no active ones.
    • Elasticsearch: Fix handling multiple datalinks for a single field.
    • Export: Fix error being thrown when exporting dashboards using query variables that reference the default datasource.
    • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
    • Login: Page no longer overflows on mobile.
    • Plugins: Set backend metadata property for core plugins.
    • Prometheus: Fill missing steps with null values.
    • Prometheus: Fix interpolation of $__rate_interval variable.
    • Prometheus: Interpolate variables with curly brackets syntax.
    • Prometheus: Respect the http-method data source setting.
    • Table: Fixes issue with field config applied to wrong fields when hiding columns.
    • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
    • Variables: Fix so data source variables are added to adhoc configuration.
  • Plugin development fixes & changes:
    • Toolkit: Revert build config so tslib is bundled with plugins to prevent plugins from crashing.
• Update to version 8.3.3:
  • BarChart: Use new data error view component to show actions in panel edit.
  • CloudMonitor: Iterate over pageToken for resources.
  • Macaron: Prevent WriteHeader invalid HTTP status code panic.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix so queryparam option works for scoped
• Update to version 8.3.2
  • Security: Fixes CVE-2021-43813 and CVE-2021-43815.
• Update to version 8.3.1
  • Security: Fixes CVE-2021-43798.
• Update to version…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update required Go version to 1.16
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400)

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch that is already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Apply patch to capture permission denied error for 'energy_uj' file (bsc#1190535)

grafana:

• Update to…

This update for grafana fixes the following issues:

Updated to version 8.5.13 (jsc#PED-2145, jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565):

• CVE-2022-36062: Fixed RBAC folders/dashboards privilege escalation (bsc#1203596).
• CVE-2022-35957: Fixed escalation from admin to server admin when auth proxy is used (bsc#1203597).
• CVE-2022-31107: Fixed OAuth account takeover (bsc#1201539).
• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-21702: Fixed XSS vulnerability in handling data sources (bsc#1195726).
• CVE-2022-21703: Fixed cross-origin request forgery vulnerability (bsc#1195727).
• CVE-2022-21713: Fixed Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728).
• CVE-2022-21673: Fixed missing error return in GetUserInfo if no user was found (bsc#1194873).
• CVE-2021-43815: Fixed directory traversal for .csv files (bsc#1193686).
• CVE-2021-41244: Fixed incorrect access control vulnerability(bsc#1192763).
• CVE-2021-41174: Fixed XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL (bsc#1192383).
• CVE-2021-3711: Fixed SM2 Decryption Buffer Overflow (bsc#1189520).
• CVE-2021-36222: Fixed a null pointer dereference in the KDC (bsc#1188571).
• CVE-2021-43798: Fixed arbitrary file read in the graph native plugin (bsc#1193492).

This update for grafana fixes the following issues:

Version update from 8.3.10 to 8.5.13 (jsc#PED-2145):

• Security fixes:

  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)

• Features and enhancements:

  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to api/ds/query
  • Rendering: Add support for renderer token
  • Setting: Support configuring feature toggles…

This update fixes the following issues:

dracut-saltboot:

• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8.

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins …

This update fixes the following issues:

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

ansible:

• Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
  • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
  • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
• Update to 2.9.22:
  • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
  • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)
• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Copy existing wicked config instead of generating new (bsc#1205599)
• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images
• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle
• Require e2fsprogs (bsc#1202614)
• Update to version 0.1.1657643023.0d694ce
  • Update dracut-saltboot dependencies (bsc#1200970)
  • Fix network loading when ipappend is used in pxe config
  • Add new information messages

golang-github-QubitProducts-exporter_exporter:

• Remove license file from %doc
• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Spec file clean up
• Fix apparmor profile for SLE 12
• Do not build with apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build with Go 1.19
• Build using promu
• Add _service file
• Fix sandboxing options
• Upgrade to version 0.13.4
  • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
• Upgrade to version 0.13.3
  • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

• Update to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API:…

John Ouyang discovered that OpenSSL incorrectly handled decrypting SM2 data. A remote attacker could use this issue to cause applications using OpenSSL to crash, resulting in a denial of service, or possibly change application behaviour. (CVE-2021-3711)

Ingo Schwarze discovered that OpenSSL incorrectly handled certain ASN.1 strings. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2021-3712)