Security update for golang-github-prometheus-alertmanager SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2139-1 Final 1 1 2022-06-20T12:56:16Z current 2022-06-20T12:56:16Z 2022-06-20T12:56:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for golang-github-prometheus-alertmanager This update for golang-github-prometheus-alertmanager fixes the following issues: Update golang-github-prometheus-alertmanager from version 0.21.0 to version 0.23.0 (bsc#1196338, jsc#SLE-24077) - CVE-2022-21698: Denial of service using InstrumentHandlerCounter - Update vendor tarball with prometheus/client_golang 1.11.1 - Update required Go version to 1.16 - Use %autosetup macro - Update to version 0.23.0: * Release 0.23.0 * Release 0.23.0-rc.0 * amtool: Detect version drift and warn users (#2672) * Add ability to skip TLS verification for amtool (#2663) * Fix empty isEqual in amtool. (#2668) * Fix main tests (#2670) * cli: add new template render command (#2538) * OpsGenie: refer to alert instead of incident (#2609) * Docs: target_match and source_match are DEPRECATED (#2665) * Fix test not waiting for cluster member to be ready - Add go_modules to _service. - Added hardening to systemd service(s) with a modified prometheus-alertmanager.service (bsc#1181400) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container ses/7.1/ceph/prometheus-alertmanager:latest-2022-2139,SUSE-2022-2139,SUSE-SLE-Manager-Tools-15-2022-2139,SUSE-SLE-Module-SUSE-Manager-Proxy-4.1-2022-2139,SUSE-SLE-Module-SUSE-Manager-Proxy-4.2-2022-2139,SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2022-2139,SUSE-Storage-6-2022-2139,openSUSE-SLE-15.3-2022-2139,openSUSE-SLE-15.4-2022-2139 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222139-1/ Link for SUSE-SU-2022:2139-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011314.html E-Mail link for SUSE-SU-2022:2139-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181400 SUSE Bug 1181400 https://bugzilla.suse.com/1196338 SUSE Bug 1196338 https://www.suse.com/security/cve/CVE-2022-21698/ SUSE CVE CVE-2022-21698 page Container ses/7.1/ceph/prometheus-alertmanager:latest SUSE Enterprise Storage 6 SUSE Manager Proxy Module 4.1 SUSE Manager Proxy Module 4.2 SUSE Manager Proxy Module 4.3 SUSE Manager Tools 15 openSUSE Leap 15.3 openSUSE Leap 15.4 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of Container ses/7.1/ceph/prometheus-alertmanager:latest golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of SUSE Enterprise Storage 6 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of SUSE Manager Proxy Module 4.1 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of SUSE Manager Proxy Module 4.2 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of SUSE Manager Proxy Module 4.3 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of SUSE Manager Tools 15 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of openSUSE Leap 15.3 golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 as a component of openSUSE Leap 15.4 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. CVE-2022-21698 Container ses/7.1/ceph/prometheus-alertmanager:latest:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 SUSE Enterprise Storage 6:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 SUSE Manager Proxy Module 4.1:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 SUSE Manager Proxy Module 4.2:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 SUSE Manager Proxy Module 4.3:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 SUSE Manager Tools 15:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 openSUSE Leap 15.3:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 openSUSE Leap 15.4:golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222139-1/ https://www.suse.com/security/cve/CVE-2022-21698.html CVE-2022-21698 https://bugzilla.suse.com/1196338 SUSE Bug 1196338