1. Home
  2. Security Advisories
  3. SUSE
  4. SUSE-SU-2023:2187-1

[SUSE-SU-2023:2187-1] Security update for Prometheus Golang clients

Severity Moderate
Affected Packages 20
CVEs 3
Info Packages References Vulnerabilities

Security update for Prometheus Golang clients

This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:

golang-github-prometheus-alertmanager:

  • Security issues fixed:
    • CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)

golang-github-prometheus-node_exporter:

  • Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
    • CVE-2022-27191: Update go/x/crypto (bsc#1197284)
    • CVE-2022-27664: Update go/x/net (bsc#1203185)
    • CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
  • Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):
    • NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
    • [BUGFIX] Fix hwmon label sanitizer
    • [BUGFIX] Use native endianness when encoding InetDiagMsg
    • [BUGFIX] Fix btrfs device stats always being zero
    • [BUGFIX] Fix diskstats exclude flags
    • [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
    • [BUGFIX] Fix concurrency issue in ethtool collector
    • [BUGFIX] Fix concurrency issue in netdev collector
    • [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
    • [BUGFIX] Fix iostat on macos broken by deprecation warning
    • [BUGFIX] Fix NodeFileDescriptorLimit alerts
    • [BUGFIX] Sanitize rapl zone names
    • [BUGFIX] Add file descriptor close safely in test
    • [BUGFIX] Fix race condition in os_release.go
    • [BUGFIX] Skip ZFS IO metrics if their paths are missing
    • [BUGFIX] Handle nil CPU thermal power status on M1
    • [BUGFIX] bsd: Ignore filesystems flagged as MNT_IGNORE
    • [BUGFIX] Sanitize UTF-8 in dmi collector
    • [CHANGE] Merge metrics descriptions in textfile collector
    • [FEATURE] Add multiple listeners and systemd socket listener activation
    • [FEATURE] [node-mixin] Add darwin dashboard to mixin
    • [FEATURE] Add 'isolated' metric on cpu collector on linux
    • [FEATURE] Add cgroup summary collector
    • [FEATURE] Add selinux collector
    • [FEATURE] Add slab info collector
    • [FEATURE] Add sysctl collector
    • [FEATURE] Also track the CPU Spin time for OpenBSD systems
    • [FEATURE] Add support for MacOS version
    • [ENHANCEMENT] Add RTNL version of netclass collector
    • [ENHANCEMENT] [node-mixin] Add missing selectors
    • [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
    • [ENHANCEMENT] [node-mixin] Change disk graph to disk table
    • [ENHANCEMENT] [node-mixin] Change io time units to %util
    • [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
    • [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
    • [ENHANCEMENT] Add device filter flags to arp collector
    • [ENHANCEMENT] Add diskstats include and exclude device flags
    • [ENHANCEMENT] Add node_softirqs_total metric
    • [ENHANCEMENT] Add rapl zone name label option
    • [ENHANCEMENT] Add slabinfo collector
    • [ENHANCEMENT] Allow user to select port on NTP server to query
    • [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
    • [ENHANCEMENT] Enable builds against older macOS SDK
    • [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
    • [ENHANCEMENT] systemd: Expose systemd minor version
    • [ENHANCEMENT] Use netlink for tcpstat collector
    • [ENHANCEMENT] Use netlink to get netdev stats
    • [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
    • [ENHANCEMENT] Add btrfs device error stats
  • Change build requirement to go1.18 or higher (previously this was fixed to version 1.14)
Package Affected Version
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=sles-15&sp=3 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=sles-15&sp=2 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=sles-15&sp=1 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=opensuse-leap-15.4 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=sles-15&sp=3 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=sles-15&sp=2 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=sles-15&sp=1 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=opensuse-leap-15.4 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=sles-15&sp=3 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=sles-15&sp=2 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=sles-15&sp=1 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=opensuse-leap-15.4 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=sles-15&sp=3 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=sles-15&sp=2 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=sles-15&sp=1 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=opensuse-leap-15.4 < 1.5.0-150100.3.23.2
pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=x86_64&distro=opensuse-leap-15.4 < 0.23.0-150100.4.13.2
pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=s390x&distro=opensuse-leap-15.4 < 0.23.0-150100.4.13.2
pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=ppc64le&distro=opensuse-leap-15.4 < 0.23.0-150100.4.13.2
pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=aarch64&distro=opensuse-leap-15.4 < 0.23.0-150100.4.13.2
ID
SUSE-SU-2023:2187-1
Severity
moderate
URL
https://www.suse.com/support/update/announcement/2023/suse-su-20232187-1/
Published
2023-05-11T17:02:04
(16 months ago)
Modified
2023-05-11T17:02:04
(16 months ago)
Rights
Copyright 2024 SUSE LLC. All rights reserved.
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=sles-15&sp=3 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 x86_64
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=sles-15&sp=2 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 x86_64
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=sles-15&sp=1 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 x86_64
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=x86_64&distro=opensuse-leap-15.4 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 opensuse-leap-15.4 x86_64
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=sles-15&sp=3 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 s390x
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=sles-15&sp=2 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 s390x
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=sles-15&sp=1 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 s390x
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=s390x&distro=opensuse-leap-15.4 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 opensuse-leap-15.4 s390x
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=sles-15&sp=3 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 ppc64le
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=sles-15&sp=2 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 ppc64le
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=sles-15&sp=1 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 ppc64le
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=ppc64le&distro=opensuse-leap-15.4 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 opensuse-leap-15.4 ppc64le
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=sles-15&sp=3 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 aarch64
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=sles-15&sp=2 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 aarch64
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=sles-15&sp=1 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 sles-15 aarch64
Affected pkg:rpm/suse/golang-github-prometheus-node_exporter?arch=aarch64&distro=opensuse-leap-15.4 suse golang-github-prometheus-node_exporter < 1.5.0-150100.3.23.2 opensuse-leap-15.4 aarch64
Affected pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=x86_64&distro=opensuse-leap-15.4 suse golang-github-prometheus-alertmanager < 0.23.0-150100.4.13.2 opensuse-leap-15.4 x86_64
Affected pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=s390x&distro=opensuse-leap-15.4 suse golang-github-prometheus-alertmanager < 0.23.0-150100.4.13.2 opensuse-leap-15.4 s390x
Affected pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=ppc64le&distro=opensuse-leap-15.4 suse golang-github-prometheus-alertmanager < 0.23.0-150100.4.13.2 opensuse-leap-15.4 ppc64le
Affected pkg:rpm/suse/golang-github-prometheus-alertmanager?arch=aarch64&distro=opensuse-leap-15.4 suse golang-github-prometheus-alertmanager < 0.23.0-150100.4.13.2 opensuse-leap-15.4 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date