Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:22027-1

Опубликовано: 06 окт. 2026
Источник: suse-cvrf

Описание

Security update for golang-github-prometheus-alertmanager

This update for golang-github-prometheus-alertmanager fixes the following issues:

Changes in golang-github-prometheus-alertmanager:

  • CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.57.0 (bsc#1266615)

  • Update to version 0.33.1 (jsc#PED-16708):

    • [BUGFIX] silences: fix silences snapshot missing legacy matchers field. This caused a bug that prevented older alertmanager versions from reading newer snapshots unnecessarily.
    • [BUGFIX] silence with no matchers should populate an empty array in API response
  • Update to version 0.33.0:

    • The '--enable-feature=auto-gomaxprocs' option has been removed.
    • Add a new Microsoft Teams integration that supports adaptive cards.
    • Add support for AWS Signature V4 to call AWS services that require authentication.
    • Add support for Google Chat as a notification channel.
    • Add support for custom payloads in webhooks.
  • Update to version 0.32.2:

    • [BUGFIX] Fix dispatcher goroutine leaks on destroyed alertgroup swap.
  • Update to version 0.32.1:

    • [BUGFIX] dispatcher: Fix issue with dispatching to a contended route.
  • Update to version 0.32.0:

    • Reduce memory allocations through pre-sizing collections and batch allocation.
    • CVE-2026-2303: Removed indirect dep on vulnerable mongodb driver (bsc#1269834)
  • Update to version 0.31.1:

    • No user-visible changes
  • Update to version 0.31.0:

    • Add full payload templating support for webhook notifier.
    • Add support for UTF-8 label names in UI matchers.
    • Fix escaping for matcher values with quotes in the UI.
  • Update to version 0.30.1:

    • [BUGFIX] Fix memory leak in tracing client.
  • Update to version 0.30.0:

    • Add Mattermost integration.
    • Add support for Slack apps.
    • Add distributed tracing support.
    • Add names to inhibition rules.
    • Add templating functions for working with URLs and JSON.
    • Allow persistent peer names in a cluster.
  • Update to version 0.29.0:

    • Add incident.io notifier.
    • Add monospace message formatting.
    • Update Jira notifier to support both Jira cloud API v3 and Jira datacenter API v2.

Список пакетов

openSUSE Leap 16.0
golang-github-prometheus-alertmanager-0.33.1-bp160.1.1

Описание

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.


Затронутые продукты
openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0.33.1-bp160.1.1

Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".


Затронутые продукты
openSUSE Leap 16.0:golang-github-prometheus-alertmanager-0.33.1-bp160.1.1

Ссылки