Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:2140-1

Опубликовано: 20 июн. 2022
Источник: suse-cvrf

Описание

Security update for node_exporter

This security update for golang-github-prometheus-node_exporter provides:

Update golang-github-prometheus-node_exporter from version 1.1.2 to version 1.3.0 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)

  • CVE-2022-21698: Denial of service using InstrumentHandlerCounter
  • Update vendor tarball with prometheus/client_golang 1.11.1
  • Update to 1.3.0
    • [CHANGE] Add path label to rapl collector #2146
    • [CHANGE] Exclude filesystems under /run/credentials #2157
    • [CHANGE] Add TCPTimeouts to netstat default filter #2189
    • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
    • [FEATURE] Add darwin powersupply collector #1777
    • [FEATURE] Add support for monitoring GPUs on Linux #1998
    • [FEATURE] Add Darwin thermal collector #2032
    • [FEATURE] Add os release collector #2094
    • [FEATURE] Add netdev.address-info collector #2105
    • [FEATURE] Add clocksource metrics to time collector #2197
    • [ENHANCEMENT] Support glob textfile collector directories #1985
    • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
    • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
    • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
    • [ENHANCEMENT] Add DMI collector #2131
    • [ENHANCEMENT] Add threads metrics to processes collector #2164
    • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
    • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
    • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
    • [BUGFIX] ethtool: Sanitize metric names #2093
    • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
    • [BUGFIX] Fix possible panic on macOS #2133
    • [BUGFIX] Collect flag_info and bug_info only for one core #2156
    • [BUGFIX] Prevent duplicate ethtool metric names #2187
  • Update to 1.2.2
    • Bug fixes Fix processes collector long int parsing #2112
  • Update to 1.2.1
    • Removed Remove obsolete capture permission denied error fix already included upstream
    • Bug fixes Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
  • Update to 1.2.0
    • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
    • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
    • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060
    • Bug fixes Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
  • Capture permission denied error for 'energy_uj' file (bsc#1190535)

Список пакетов

Container ses/7.1/ceph/prometheus-node-exporter:latest
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Container suse/manager/5.0/x86_64/server:latest
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP2-SAP-Azure-LI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP3-SAP-Azure-LI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP4-SAP-Azure-LI-BYOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP4-SAP-Azure-LI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP4-SAP-Azure-VLI-BYOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP5-SAP-Azure-LI-BYOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP5-SAP-Azure-LI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP5-SAP-Azure-VLI-BYOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP6-SAP-Azure-LI-BYOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP6-SAP-Azure-LI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP6-SAP-Azure-VLI-BYOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP6-SAP-Azure-VLI-BYOS-Production
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image server-image
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Enterprise Storage 6
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Enterprise Storage 7
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Module for Basesystem 15 SP3
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Module for Basesystem 15 SP4
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Server 15 SP1-BCL
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Server 15 SP1-LTSS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Server 15 SP2-BCL
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Server 15 SP2-LTSS
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Manager Proxy 4.1
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Manager Retail Branch Server 4.1
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
SUSE Manager Server 4.1
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
openSUSE Leap 15.3
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
openSUSE Leap 15.4
golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1

Описание

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.


Затронутые продукты
Container ses/7.1/ceph/prometheus-node-exporter:latest:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Container suse/manager/5.0/x86_64/server:latest:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1
Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1

Ссылки
Уязвимость SUSE-SU-2022:2140-1