rpm package
suse/golang-github-prometheus-prometheus&distro=SUSE Manager Client Tools 15
pkg:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE%20Manager%20Client%20Tools%2015
Vulnerabilities (50)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2024-9264 | — | < 2.53.4-150000.3.62.2 | 2.53.4-150000.3.62.2 | Oct 18, 2024 | The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user wit | ||
| CVE-2024-8118 | Med | — | < 2.53.3-150000.3.59.1 | 2.53.3-150000.3.59.1 | Sep 26, 2024 | In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules. | |
| CVE-2024-6104 | — | < 2.45.6-150000.3.56.1 | 2.45.6-150000.3.56.1 | Jun 24, 2024 | go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. | ||
| CVE-2023-45288 | Hig | 7.5 | < 2.53.4-150000.3.62.2 | 2.53.4-150000.3.62.2 | Apr 4, 2024 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed Ma | |
| CVE-2023-6152 | — | < 2.53.3-150000.3.59.1 | 2.53.3-150000.3.59.1 | Feb 13, 2024 | A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. | ||
| CVE-2023-45142 | — | < 2.45.6-150000.3.56.1 | 2.45.6-150000.3.56.1 | Oct 12, 2023 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests | ||
| CVE-2023-29409 | — | < 2.45.0-150000.3.50.3 | 2.45.0-150000.3.50.3 | Aug 2, 2023 | Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr | ||
| CVE-2023-3128 | — | < 2.53.3-150000.3.59.1 | 2.53.3-150000.3.59.1 | Jun 22, 2023 | Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. | ||
| CVE-2022-41723 | — | < 2.45.0-150000.3.50.3 | 2.45.0-150000.3.50.3 | Feb 28, 2023 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests. | ||
| CVE-2022-46146 | — | < 2.37.6-150000.3.47.2 | 2.37.6-150000.3.47.2 | Nov 29, 2022 | Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0. | ||
| CVE-2022-41715 | — | < 2.37.6-150000.3.47.2 | 2.37.6-150000.3.47.2 | Oct 14, 2022 | Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively sm | ||
| CVE-2022-32149 | — | < 2.45.0-150000.3.50.3 | 2.45.0-150000.3.50.3 | Oct 14, 2022 | An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse. | ||
| CVE-2021-43138 | — | < 2.45.0-150000.3.53.1 | 2.45.0-150000.3.53.1 | Apr 6, 2022 | In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. | ||
| CVE-2022-21698 | — | < 2.32.1-150000.3.41.2 | 2.32.1-150000.3.41.2 | Feb 15, 2022 | client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounde | ||
| CVE-2022-0155 | — | < 2.45.0-150000.3.53.1 | 2.45.0-150000.3.53.1 | Jan 10, 2022 | follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor | ||
| CVE-2021-43815 | — | < 2.45.0-150000.3.53.1 | 2.45.0-150000.3.53.1 | Dec 10, 2021 | Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured | ||
| CVE-2021-43798 | — | KEV | < 2.45.0-150000.3.53.1 | 2.45.0-150000.3.53.1 | Dec 7, 2021 | Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`, | |
| CVE-2021-3918 | — | < 2.45.0-150000.3.53.1 | 2.45.0-150000.3.53.1 | Nov 13, 2021 | json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | ||
| CVE-2021-3807 | — | < 2.45.0-150000.3.53.1 | 2.45.0-150000.3.53.1 | Sep 17, 2021 | ansi-regex is vulnerable to Inefficient Regular Expression Complexity | ||
| CVE-2021-29622 | — | < 2.27.1-3.31.1 | 2.27.1-3.31.1 | May 19, 2021 | Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL |
- CVE-2024-9264Oct 18, 2024affected < 2.53.4-150000.3.62.2fixed 2.53.4-150000.3.62.2
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user wit
- affected < 2.53.3-150000.3.59.1fixed 2.53.3-150000.3.59.1
In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules.
- CVE-2024-6104Jun 24, 2024affected < 2.45.6-150000.3.56.1fixed 2.45.6-150000.3.56.1
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.
- affected < 2.53.4-150000.3.62.2fixed 2.53.4-150000.3.62.2
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed Ma
- CVE-2023-6152Feb 13, 2024affected < 2.53.3-150000.3.59.1fixed 2.53.3-150000.3.59.1
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up.
- CVE-2023-45142Oct 12, 2023affected < 2.45.6-150000.3.56.1fixed 2.45.6-150000.3.56.1
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests
- CVE-2023-29409Aug 2, 2023affected < 2.45.0-150000.3.50.3fixed 2.45.0-150000.3.50.3
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are curr
- CVE-2023-3128Jun 22, 2023affected < 2.53.3-150000.3.59.1fixed 2.53.3-150000.3.59.1
Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
- CVE-2022-41723Feb 28, 2023affected < 2.45.0-150000.3.50.3fixed 2.45.0-150000.3.50.3
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
- CVE-2022-46146Nov 29, 2022affected < 2.37.6-150000.3.47.2fixed 2.37.6-150000.3.47.2
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.
- CVE-2022-41715Oct 14, 2022affected < 2.37.6-150000.3.47.2fixed 2.37.6-150000.3.47.2
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively sm
- CVE-2022-32149Oct 14, 2022affected < 2.45.0-150000.3.50.3fixed 2.45.0-150000.3.50.3
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
- CVE-2021-43138Apr 6, 2022affected < 2.45.0-150000.3.53.1fixed 2.45.0-150000.3.53.1
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
- CVE-2022-21698Feb 15, 2022affected < 2.32.1-150000.3.41.2fixed 2.32.1-150000.3.41.2
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounde
- CVE-2022-0155Jan 10, 2022affected < 2.45.0-150000.3.53.1fixed 2.45.0-150000.3.53.1
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
- CVE-2021-43815Dec 10, 2021affected < 2.45.0-150000.3.53.1fixed 2.45.0-150000.3.53.1
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 has a directory traversal for arbitrary .csv files. It only affects instances that have the developer testing tool called TestData DB data source enabled and configured
- affected < 2.45.0-150000.3.53.1fixed 2.45.0-150000.3.53.1
Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vulnerable to directory traversal, allowing access to local files. The vulnerable URL path is: `<grafana_host_url>/public/plugins//`,
- CVE-2021-3918Nov 13, 2021affected < 2.45.0-150000.3.53.1fixed 2.45.0-150000.3.53.1
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CVE-2021-3807Sep 17, 2021affected < 2.45.0-150000.3.53.1fixed 2.45.0-150000.3.53.1
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
- CVE-2021-29622May 19, 2021affected < 2.27.1-3.31.1fixed 2.27.1-3.31.1
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL
Page 2 of 3