Описание
Security update for golang-github-prometheus-alertmanager
This update for golang-github-prometheus-alertmanager fixes the following issues:
Changes in golang-github-prometheus-alertmanager:
-
CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.57.0 (bsc#1266615)
-
Update to version 0.33.1 (jsc#PED-16708):
- [BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily.
- [BUGFIX] silence with no matchers should populate an empty array in API response
-
Update to version 0.33.0:
- The '--enable-feature=auto-gomaxprocs' option has been removed.
- Add a new Microsoft Teams integration that supports adaptive cards.
- Add support for AWS Signature V4 to call AWS services that require authentication.
- Add support for Google Chat as a notification channel.
- Add support for custom payloads in webhooks.
-
Update to version 0.32.2:
- [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap.
-
Update to version 0.32.1:
- [BUGFIX] dispatcher: Fix issue with dispatching to a contended route.
-
Update to version 0.32.0:
- Reduce memory allocations through pre-sizing collections and batch allocation.
- CVE-2026-2303: Removed indirect dep on vulnerable mongodb driver (bsc#1269834)
-
Update to version 0.31.1:
- No user-visible changes
-
Update to version 0.31.0:
- Add full payload templating support for webhook notifier.
- Add support for UTF-8 label names in UI matchers.
- Fix escaping for matcher values with quotes in the UI.
-
Update to version 0.30.1:
- [BUGFIX] Fix memory leak in tracing client.
-
Update to version 0.30.0:
- Add Mattermost integration.
- Add support for Slack apps.
- Add distributed tracing support.
- Add names to inhibition rules.
- Add templating functions for working with URLs and JSON.
- Allow persistent peer names in a cluster.
-
Update to version 0.29.0:
- Add incident.io notifier.
- Add monospace message formatting.
- Update Jira notifier to support both Jira cloud API v3 and Jira datacenter API v2.
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1266615
- SUSE Bug 1269834
- SUSE CVE CVE-2026-2303 page
- SUSE CVE CVE-2026-39821 page
Описание
The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.
Затронутые продукты
Ссылки
- CVE-2026-2303
- SUSE Bug 1268652
Описание
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Затронутые продукты
Ссылки
- CVE-2026-39821
- SUSE Bug 1266474