Security update for firewalld, golang-github-prometheus-prometheus SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:1435-1 Final 1 1 2022-04-27T12:34:56Z current 2022-04-27T12:34:56Z 2022-04-27T12:34:56Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for firewalld, golang-github-prometheus-prometheus This update for firewalld, golang-github-prometheus-prometheus fixes the following issues: Security fixes for golang-github-prometheus-prometheus: - CVE-2022-21698: Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods (bsc#1196338). Other non security changes for golang-github-prometheus-prometheus: - Build `firewalld-prometheus-config` only for SUSE Linux Enterprise 15, 15-SP1 and 15-SP2, and require `firewalld`. - Only recommends `firewalld-prometheus-config` as prometheus does not require it to run. - Create `firewalld-prometheus-config` subpackage (bsc#1197042, jsc#SLE-24373, jsc#SLE-24374, jsc#SLE-24375) Other non security changes for firewalld: - Provide dummy `firewalld-prometheus-config` package (bsc#1197042) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container ses/7.1/ceph/prometheus-server:latest-2022-1435,Image SLES15-SP3-HPC-BYOS-Azure-2022-1435,Image SLES15-SP3-HPC-BYOS-EC2-HVM-2022-1435,Image SLES15-SP3-HPC-BYOS-GCE-2022-1435,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure-2022-1435,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM-2022-1435,Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE-2022-1435,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2022-1435,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2022-1435,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2022-1435,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2022-1435,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2022-1435,Image SLES15-SP3-SAP-BYOS-Azure-2022-1435,Image SLES15-SP3-SAP-BYOS-EC2-HVM-2022-1435,Image SLES15-SP3-SAP-BYOS-GCE-2022-1435,Image SLES15-SP3-SAPCAL-Azure-2022-1435,Image SLES15-SP3-SAPCAL-EC2-HVM-2022-1435,Image SLES15-SP3-SAPCAL-GCE-2022-1435,SUSE-2022-1435,SUSE-SLE-Module-Basesystem-15-SP3-2022-1435,SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-1435,SUSE-SLE-Module-SUSE-Manager-Proxy-4.1-2022-1435,SUSE-SLE-Module-SUSE-Manager-Proxy-4.2-2022-1435,SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2022-1435,SUSE-SUSE-MicroOS-5.1-2022-1435,SUSE-SUSE-MicroOS-5.2-2022-1435,SUSE-Storage-6-2022-1435,openSUSE-SLE-15.3-2022-1435,openSUSE-SLE-15.4-2022-1435 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20221435-1/ Link for SUSE-SU-2022:1435-1 https://lists.suse.com/pipermail/sle-security-updates/2022-April/010854.html E-Mail link for SUSE-SU-2022:1435-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1196338 SUSE Bug 1196338 https://bugzilla.suse.com/1197042 SUSE Bug 1197042 https://www.suse.com/security/cve/CVE-2022-21698/ SUSE CVE CVE-2022-21698 page Container ses/7.1/ceph/prometheus-server:latest Image SLES15-SP3-HPC-BYOS-Azure Image SLES15-SP3-HPC-BYOS-EC2-HVM Image SLES15-SP3-HPC-BYOS-GCE Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-EC2-HVM Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP3-SAPCAL-Azure Image SLES15-SP3-SAPCAL-EC2-HVM Image SLES15-SP3-SAPCAL-GCE SUSE Enterprise Storage 6 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Manager Proxy Module 4.1 SUSE Manager Proxy Module 4.2 openSUSE Leap 15.3 openSUSE Leap 15.4 golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 firewalld-0.9.3-150300.3.6.1 python3-firewall-0.9.3-150300.3.6.1 firewall-macros-0.9.3-150300.3.6.1 firewall-applet-0.9.3-150300.3.6.1 firewall-config-0.9.3-150300.3.6.1 firewalld-lang-0.9.3-150300.3.6.1 firewalld-prometheus-config-0.1-150100.4.9.2 golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 as a component of Container ses/7.1/ceph/prometheus-server:latest firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-HPC-BYOS-Azure python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-HPC-BYOS-Azure firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-HPC-BYOS-EC2-HVM python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-HPC-BYOS-EC2-HVM firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-HPC-BYOS-GCE python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-HPC-BYOS-GCE firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-Azure firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-Azure python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-Azure firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-EC2-HVM firewall-macros-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-GCE firewalld-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-GCE python3-firewall-0.9.3-150300.3.6.1 as a component of Image SLES15-SP3-SAPCAL-GCE firewalld-prometheus-config-0.1-150100.4.9.2 as a component of SUSE Enterprise Storage 6 golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 as a component of SUSE Enterprise Storage 6 firewalld-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Micro 5.1 python3-firewall-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Micro 5.1 firewalld-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Micro 5.2 python3-firewall-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Micro 5.2 firewall-macros-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 firewalld-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 firewalld-lang-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 python3-firewall-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 firewall-applet-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 firewall-config-0.9.3-150300.3.6.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP3 firewalld-prometheus-config-0.1-150100.4.9.2 as a component of SUSE Manager Proxy Module 4.1 golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 as a component of SUSE Manager Proxy Module 4.1 golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 as a component of SUSE Manager Proxy Module 4.2 firewall-applet-0.9.3-150300.3.6.1 as a component of openSUSE Leap 15.3 firewall-config-0.9.3-150300.3.6.1 as a component of openSUSE Leap 15.3 firewall-macros-0.9.3-150300.3.6.1 as a component of openSUSE Leap 15.3 firewalld-0.9.3-150300.3.6.1 as a component of openSUSE Leap 15.3 firewalld-lang-0.9.3-150300.3.6.1 as a component of openSUSE Leap 15.3 golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 as a component of openSUSE Leap 15.3 python3-firewall-0.9.3-150300.3.6.1 as a component of openSUSE Leap 15.3 golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 as a component of openSUSE Leap 15.4 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. CVE-2022-21698 Container ses/7.1/ceph/prometheus-server:latest:golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 Image SLES15-SP3-HPC-BYOS-Azure:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-HPC-BYOS-Azure:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-HPC-BYOS-EC2-HVM:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-HPC-BYOS-EC2-HVM:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-HPC-BYOS-GCE:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-HPC-BYOS-GCE:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-EC2-HVM:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Proxy-BYOS-GCE:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-Azure:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-Azure:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-Azure:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-GCE:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-GCE:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAP-BYOS-GCE:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-Azure:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-Azure:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-Azure:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-EC2-HVM:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-EC2-HVM:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-EC2-HVM:python3-firewall-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-GCE:firewall-macros-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-GCE:firewalld-0.9.3-150300.3.6.1 Image SLES15-SP3-SAPCAL-GCE:python3-firewall-0.9.3-150300.3.6.1 SUSE Enterprise Storage 6:firewalld-prometheus-config-0.1-150100.4.9.2 SUSE Enterprise Storage 6:golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 SUSE Linux Enterprise Micro 5.1:firewalld-0.9.3-150300.3.6.1 SUSE Linux Enterprise Micro 5.1:python3-firewall-0.9.3-150300.3.6.1 SUSE Linux Enterprise Micro 5.2:firewalld-0.9.3-150300.3.6.1 SUSE Linux Enterprise Micro 5.2:python3-firewall-0.9.3-150300.3.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:firewall-macros-0.9.3-150300.3.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:firewalld-0.9.3-150300.3.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:firewalld-lang-0.9.3-150300.3.6.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:python3-firewall-0.9.3-150300.3.6.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:firewall-applet-0.9.3-150300.3.6.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP3:firewall-config-0.9.3-150300.3.6.1 SUSE Manager Proxy Module 4.1:firewalld-prometheus-config-0.1-150100.4.9.2 SUSE Manager Proxy Module 4.1:golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 SUSE Manager Proxy Module 4.2:golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 openSUSE Leap 15.3:firewall-applet-0.9.3-150300.3.6.1 openSUSE Leap 15.3:firewall-config-0.9.3-150300.3.6.1 openSUSE Leap 15.3:firewall-macros-0.9.3-150300.3.6.1 openSUSE Leap 15.3:firewalld-0.9.3-150300.3.6.1 openSUSE Leap 15.3:firewalld-lang-0.9.3-150300.3.6.1 openSUSE Leap 15.3:golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 openSUSE Leap 15.3:python3-firewall-0.9.3-150300.3.6.1 openSUSE Leap 15.4:golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20221435-1/ https://www.suse.com/security/cve/CVE-2022-21698.html CVE-2022-21698 https://bugzilla.suse.com/1196338 SUSE Bug 1196338