SUSE SLES12 Security Update : SUSE Manager Client Tools (SUSE-SU-2020:1970-1)

This update fixes the following issues : cobbler : Calculate relative path for kernel and inited when generating grub entry bsc1170231 Added: fix-grub2-entry-paths.diff Fix os-release version detection for SUSE Modified: sles15.patch Jinja2 template library fix bsc1141661 Removes string replace f...

openSUSE Security Update : grafana / grafana-piechart-panel / grafana-status-panel (openSUSE-2020-892)

This update for grafana, grafana-piechart-panel, grafana-status-panel fixes the following issues : grafana was updated to version 7.0.3 : - Features / Enhancements - Stats: include all fields. 24829, @ryantxu - Variables: change VariableEditorList row action Icon to IconButton. 25217, @hshoff - B...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0 servicemesh-prometheus security update

An update for servicemesh-prometheus is now available for OpenShift Service Mesh 1.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Fedora 31 : fwupd (2020-ad1c74c2a1)

New upstream release - Actually reload the DFU device after upgrade has completed - Capture the dock SKU in report metadata - Correctly set the Logitech device protocol - Do not use shim for non-secure boot configurations - Ensure that the DeviceID is set for child devices - Fix an error when...

SUSE-SU-2020:1718-1 Security Beta update for SUSE Manager Client Tools and Salt

This update fixes the following issues: cobbler: - Calculate relative path for kernel and inited when generating grub entry bsc1170231 Added: fix-grub2-entry-paths.diff - Fix os-release version detection for SUSE Modified: sles15.patch - Jinja2 template library fix bsc1141661 - Removes string...

SUSE-SU-2020:1715-1 Security Beta update for SUSE Manager Client Tools and Salt

This update fixes the following issues: dracut-saltboot: - Print a list of available disk devices bsc1170824 - Install wipefs to initrd - Force install crypt modules - Add missing terminal naming modifiers as exported veriables golang-github-prometheus-prometheus: - Update change log and spec fil...

Mail.ru: Information Disclosure on {http://pro.tracker.my.com}

Prometheus performance metrics were publicly available on pro.tracker.my.com...

GitLab: SSRF on project import via the remote_attachment_url on a Note

Summary The Note model has an attachment which is provided by a CarrierWave uploader: ruby mountuploader :attachment, AttachmentUploader One of the features this provides is the ability to download and attach a file via a url, see...

CVE-2018-1002104

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

Exposed Endpoints

github.com/kubernetes/ingress-nginx is uses publicly exposed endpoints. The prometheus metrics and healthz of the Kubernetes defaultbackend can be accessed by a remote attacker using a port-forward request to access the publicly accessible metrics...

CVE-2018-1002104

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

CVE-2018-1002104

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

Default credentials

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

CVE-2018-1002104

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

CVE-2018-1002104

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

CVE-2018-1002104

CVE-2018-1002104 affects Kubernetes ingress default backend versions = 1.5) is implied but not confirmed in these sources.

PT-2020-8511

Name of the Vulnerable Software and Affected Versions: Kubernetes ingress default backend versions prior to 1.5 Description: The issue concerns the exposure of Prometheus metrics publicly due to the Kubernetes ingress default backend handling invalid ingress traffic improperly. Recommendations: F...

CVE-2018-1002104: Insertion of Sensitive Information Into Debugging Code

Versions 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly...

U.S. Dept Of Defense: Publicly accessible Grafana install allows pivoting to Prometheus datasource

Summary: A publicly accessible Grafana install exposes semi sensitive Dashboards. This also exposes the Prometheus proxied datasources which allow direct queries to a Prometheus instance which reveals sensitive data an opens the instance up to potential DoS via crafted requests. Description: Impa...

openSUSE Security Update : haproxy (openSUSE-2019-2556)

This update for haproxy to version 2.0.5+git0.d905f49a fixes the following issues : Security issue fixed : - CVE-2019-14241: Fixed a cookie memory corruption problem. bsc1142529 The update to 2.0.5 brings lots of features and bugfixes : - new internal native HTTP representation called HTX, was...