USN-6935-1: Prometheus Alertmanager vulnerability

It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code. On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only present if...

USN-6935-1 prometheus-alertmanager vulnerability

It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code. On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only present if...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Prometheus Alertmanager vulnerability (USN-6935-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6935-1 advisory. It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with...

CVE-2022-21698 affecting package prometheus-process-exporter for versions less than 0.8.2-1

CVE-2022-21698 affecting package prometheus-process-exporter for versions less than 0.8.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-44716 affecting package prometheus-process-exporter for versions less than 0.8.2-1

CVE-2021-44716 affecting package prometheus-process-exporter for versions less than 0.8.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45288 affecting package prometheus-adapter for versions less than 0.12.0-1

CVE-2023-45288 affecting package prometheus-adapter for versions less than 0.12.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.12.0-1

CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.12.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1

CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45142 affecting package prometheus-adapter for versions less than 0.12.0-1

CVE-2023-45142 affecting package prometheus-adapter for versions less than 0.12.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-3978 affecting package prometheus-adapter for versions less than 0.12.0-1

CVE-2023-3978 affecting package prometheus-adapter for versions less than 0.12.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-46146 affecting package prometheus-process-exporter for versions less than 0.8.2-1

CVE-2022-46146 affecting package prometheus-process-exporter for versions less than 0.8.2-1. An upgraded version of the package is available that resolves this issue...

GHSA-MH55-GQVF-XFWM vulnerabilities

Vulnerabilities for packages: grafana-mimir, rekor, fulcio, prometheus-alertmanager, cortex, timestamp-authority...

CBL Mariner 2.0 Security Update: cri-tools / docker-buildx / kubernetes / opa / prometheus (CVE-2023-45142)

The version of cri-tools / docker-buildx / kubernetes / opa / prometheus installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-45142 advisory. - OpenTelemetry-Go Contrib is a collection of third-party...

OPENSUSE-SU-2024:14092-1 golang-github-prometheus-prometheus-2.53.0-2.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-2.53.0-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-24791 vulnerabilities

Vulnerabilities for packages: prometheus-redis-exporter-fips, kubewatch, kubernetes-dashboard-metrics-scraper, dagdotdev, crossplane-provider-aws, extism, aws-flb-cloudwatch, logstash-exporter-fips, nri-memcached, configmap-reload, prometheus-statsd-exporter,...

GHSA-V6V8-XJ6M-XWQH vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, slsa-verifier, tekton-chains, cosign, gomplate-fips, terragrunt, snyk-cli, buildkitd, flux-kustomize-controller, k3d, terraform-provider-azurerm, cosign-fips, rekor, rekor-fips, timestamp-authority, argo-events-fips, step-ca-fips,...

CVE-2024-6104 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-fips, slsa-verifier, tekton-chains, cosign, gomplate-fips, terragrunt, snyk-cli, buildkitd, flux-kustomize-controller, k3d, terraform-provider-azurerm, cosign-fips, rekor, rekor-fips, timestamp-authority, argo-events-fips, step-ca-fips,...

AZL-42898 CVE-2024-6104 affecting package prometheus for versions less than 2.45.4-3

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

AZL-42928 CVE-2024-6104 affecting package prometheus for versions less than 2.37.0-14

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

Security Bulletin: IBM DataPower Gateway is vulnerable to denial of service due to Golang Go

Summary IBM DataPower Gateway is vulnerable to denial of service due to use of Golang Go in DataPower Operator and Prometheus Metrics . CVE-2024-24783 Vulnerability Details CVEID:CVE-2024-24783 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw in the crypto/x509 packag...