SUSE-SU-2023:2297-2 Security update for golang-github-vpenso-prometheus_slurm_exporter

This update of golang-github-vpenso-prometheusslurmexporter fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441 bsc1209658...

SUSE SLED15: golang-github-prometheus-alertmanager / etc (SUSE-SU-2023:2187-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2187-1 advisory. golang-github-prometheus-alertmanager: - Security issues fixed: CVE-2022-46146: Fix authenticati...

openSUSE 15: golang-github-prometheus-promu / prometheus-blackbox_exporter / etc (SUSE-SU-2023:2182-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2182-1 advisory. prometheus-blackboxexporter: - Security issues fixed: CVE-2022-46146: Fix authentication bypass via cache poisoning bsc1208062 - Other non-security...

SUSE: Security Advisory (SUSE-SU-2023:2183-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES12 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:2183-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2183-1 advisory. golang-github-prometheus-alertmanager: - Security issues fixed: CVE-2022-46146: Fix authentication bypass via cache poisoning...

SUSE-EL-9-CLIENT-TOOLS-2023-2185 Security update for SUSE Manager Client Tools

This update fixes the following issues: prometheus-postgresexporter: - Security issues fixed: CVE-2022-46146: Fix authentication bypass via cache poisoning bsc1208060 - Other non-security issues fixed: Adapt the systemd service security configuration to be able to start it on for Red Hat Linux...

The vulnerability of the bcrypt hashing algorithm implementation in the system file exporter tool for Prometheus Exporter Toolkit allows a hacker to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the bcrypt hashing algorithm implementation in the Prometheus Exporter Toolkit’s file export function is related to the ability to bypass authentication when processing the web.yml file. Exploiting this vulnerability can allow attackers to circumvent security restrictions and...

SUSE-SU-2023:1859-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: - CVE-2022-46146: Fixed authentication bypass via cache poisoning in Prometheus Exporter Toolkit bsc1208049...

SUSE-SU-2023:1858-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: - CVE-2022-46146: Fixed authentication bypass via cache poisoning in Prometheus Exporter Toolkit bsc1208049...

SUSE-SU-2023:1857-1 Security update for golang-github-prometheus-prometheus

This update for golang-github-prometheus-prometheus fixes the following issues: - CVE-2022-46146: Fixed authentication bypass via cache poisoning in Prometheus Exporter Toolkit bsc1208049...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : grafana (SUSE-SU-2023:0821-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0821-1 advisory. - CVE-2022-23552: Fixed SVG processing by adding a dompurify preprocessor step bsc1207749. -...

SUSE SLES12 Security Update : prometheus-ha_cluster_exporter (SUSE-SU-2023:0467-1)

The remote SUSE Linux SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:0467-1 advisory. Updated to version 1.3.1: - CVE-2022-46146: Fixed authentication bypass via cache poisoning in prometheus/exporter-toolkit bsc1208046, bsc1208047...

FreeBSD : node_exporter -- bypass security with cache poisoning (d835c54f-a4bd-11ed-b6af-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the d835c54f-a4bd-11ed-b6af-b42e991fc52e advisory. - Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8....

Prometheus Exporter-Toolkit is vulnerable to authentication bypass

Impact Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password back. However, a flaw ...

Authentication Bypass

github.com/prometheus/exporter-toolkit is vulnerable to authentication bypass. It is possible to bypass the security mechanisms by poisoning the built-in authentication cache when an attacker has access to the web.yml file and user's hashed bcrypted passwords...

CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...

DEBIAN-CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...

Design/Logic Flaw

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...

CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...

UBUNTU-CVE-2022-46146

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix...