Security update for node_exporter SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2140-1 Final 1 1 2022-06-20T12:58:53Z current 2022-06-20T12:58:53Z 2022-06-20T12:58:53Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for node_exporter This security update for golang-github-prometheus-node_exporter provides: Update golang-github-prometheus-node_exporter from version 1.1.2 to version 1.3.0 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239) - CVE-2022-21698: Denial of service using InstrumentHandlerCounter - Update vendor tarball with prometheus/client_golang 1.11.1 - Update to 1.3.0 * [CHANGE] Add path label to rapl collector #2146 * [CHANGE] Exclude filesystems under /run/credentials #2157 * [CHANGE] Add TCPTimeouts to netstat default filter #2189 * [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771 * [FEATURE] Add darwin powersupply collector #1777 * [FEATURE] Add support for monitoring GPUs on Linux #1998 * [FEATURE] Add Darwin thermal collector #2032 * [FEATURE] Add os release collector #2094 * [FEATURE] Add netdev.address-info collector #2105 * [FEATURE] Add clocksource metrics to time collector #2197 * [ENHANCEMENT] Support glob textfile collector directories #1985 * [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080 * [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165 * [ENHANCEMENT] Add flag to disable guest CPU metrics #2123 * [ENHANCEMENT] Add DMI collector #2131 * [ENHANCEMENT] Add threads metrics to processes collector #2164 * [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169 * [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189 * [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208 * [BUGFIX] ethtool: Sanitize metric names #2093 * [BUGFIX] Fix ethtool collector for multiple interfaces #2126 * [BUGFIX] Fix possible panic on macOS #2133 * [BUGFIX] Collect flag_info and bug_info only for one core #2156 * [BUGFIX] Prevent duplicate ethtool metric names #2187 - Update to 1.2.2 * Bug fixes Fix processes collector long int parsing #2112 - Update to 1.2.1 * Removed Remove obsolete capture permission denied error fix already included upstream * Bug fixes Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092 - Update to 1.2.0 * Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203 * Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062 * Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 * Bug fixes Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067 - Capture permission denied error for 'energy_uj' file (bsc#1190535) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container ses/7.1/ceph/prometheus-node-exporter:latest-2022-2140,Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2022-2140,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2022-2140,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2022-2140,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2022-2140,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2022-2140,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2022-2140,Image SLES15-SP4-SAP-Azure-LI-BYOS-2022-2140,Image SLES15-SP4-SAP-Azure-LI-BYOS-Production-2022-2140,Image SLES15-SP4-SAP-Azure-VLI-BYOS-2022-2140,Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production-2022-2140,Image SLES15-SP5-SAP-Azure-LI-BYOS-2022-2140,Image SLES15-SP5-SAP-Azure-LI-BYOS-Production-2022-2140,Image SLES15-SP5-SAP-Azure-VLI-BYOS-2022-2140,Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production-2022-2140,SUSE-2022-2140,SUSE-SLE-Module-Basesystem-15-SP3-2022-2140,SUSE-SLE-Module-Basesystem-15-SP4-2022-2140,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-2140,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-2140,SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-2140,SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-2140,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-2140,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-2140,SUSE-SLE-Product-SLES-15-SP2-BCL-2022-2140,SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-2140,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-2140,SUSE-SLE-Product-SLES_SAP-15-SP2-2022-2140,SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-2140,SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-2140,SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-2140,SUSE-Storage-6-2022-2140,SUSE-Storage-7-2022-2140,openSUSE-SLE-15.3-2022-2140,openSUSE-SLE-15.4-2022-2140 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222140-1/ Link for SUSE-SU-2022:2140-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011315.html E-Mail link for SUSE-SU-2022:2140-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1190535 SUSE Bug 1190535 https://bugzilla.suse.com/1196338 SUSE Bug 1196338 https://www.suse.com/security/cve/CVE-2022-21698/ SUSE CVE CVE-2022-21698 page Container ses/7.1/ceph/prometheus-node-exporter:latest Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Server 15 SP1-BCL SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-BCL SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Manager Proxy 4.1 SUSE Manager Retail Branch Server 4.1 SUSE Manager Server 4.1 openSUSE Leap 15.3 openSUSE Leap 15.4 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Container ses/7.1/ceph/prometheus-node-exporter:latest golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Enterprise Storage 6 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Enterprise Storage 7 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Server 15 SP2-BCL golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Server 15 SP2-LTSS golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Manager Proxy 4.1 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Manager Retail Branch Server 4.1 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of SUSE Manager Server 4.1 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of openSUSE Leap 15.3 golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 as a component of openSUSE Leap 15.4 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. CVE-2022-21698 Container ses/7.1/ceph/prometheus-node-exporter:latest:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Enterprise Storage 6:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Enterprise Storage 7:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Server 15 SP1-BCL:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Server 15 SP1-LTSS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Server 15 SP2-BCL:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Server 15 SP2-LTSS:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Server for SAP Applications 15 SP1:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Manager Proxy 4.1:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Manager Retail Branch Server 4.1:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 SUSE Manager Server 4.1:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 openSUSE Leap 15.3:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 openSUSE Leap 15.4:golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222140-1/ https://www.suse.com/security/cve/CVE-2022-21698.html CVE-2022-21698 https://bugzilla.suse.com/1196338 SUSE Bug 1196338