Security update for Prometheus Golang clients

Announcement ID:	SUSE-SU-2023:2187-1
Rating:	moderate
References:	bsc#1197284 bsc#1203185 bsc#1208051 bsc#1208064 jsc#PED-3578
Cross-References:	CVE-2022-27191 CVE-2022-27664 CVE-2022-46146
CVSS scores:	CVE-2022-27191 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27191 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27664 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-27664 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2022-46146 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2022-46146 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	Basesystem Module 15-SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Leap 15.5 SUSE CaaS Platform 4.0 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15 SUSE Linux Enterprise Desktop 15 SP1 SUSE Linux Enterprise Desktop 15 SP2 SUSE Linux Enterprise Desktop 15 SP3 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SUSE Linux Enterprise High Performance Computing 15 SP1 SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 SUSE Linux Enterprise High Performance Computing 15 SP2 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Real Time 15 SP1 SUSE Linux Enterprise Real Time 15 SP2 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Real Time 15 SP4 SUSE Linux Enterprise Real Time 15 SP5 SUSE Linux Enterprise Server 15 SUSE Linux Enterprise Server 15 SP1 SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 SUSE Linux Enterprise Server 15 SP2 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Manager Client Tools for SLE 15 SUSE Manager Client Tools for SLE Micro 5 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.2 Module 4.2 SUSE Manager Proxy 4.3 SUSE Manager Proxy 4.3 Module 4.3 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.2 SUSE Manager Server 4.3

An update that solves three vulnerabilities, contains one feature and has one security fix can now be installed.

Description:

This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:

golang-github-prometheus-alertmanager:

• Security issues fixed:
• CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)

golang-github-prometheus-node_exporter:

• Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
• CVE-2022-27191: Update go/x/crypto (bsc#1197284)
• CVE-2022-27664: Update go/x/net (bsc#1203185)
• CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
• Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):
• NOTE: This changes the Go runtime "GOMAXPROCS" to 1. This is done to limit the concurrency of the exporter to 1 CPU thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with high numbers of CPUs/CPU threads.
• [BUGFIX] Fix hwmon label sanitizer
• [BUGFIX] Use native endianness when encoding InetDiagMsg
• [BUGFIX] Fix btrfs device stats always being zero
• [BUGFIX] Fix diskstats exclude flags
• [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning
• [BUGFIX] Fix concurrency issue in ethtool collector
• [BUGFIX] Fix concurrency issue in netdev collector
• [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes
• [BUGFIX] Fix iostat on macos broken by deprecation warning
• [BUGFIX] Fix NodeFileDescriptorLimit alerts
• [BUGFIX] Sanitize rapl zone names
• [BUGFIX] Add file descriptor close safely in test
• [BUGFIX] Fix race condition in os_release.go
• [BUGFIX] Skip ZFS IO metrics if their paths are missing
• [BUGFIX] Handle nil CPU thermal power status on M1
• [BUGFIX] bsd: Ignore filesystems flagged as MNT_IGNORE
• [BUGFIX] Sanitize UTF-8 in dmi collector
• [CHANGE] Merge metrics descriptions in textfile collector
• [FEATURE] Add multiple listeners and systemd socket listener activation
• [FEATURE] [node-mixin] Add darwin dashboard to mixin
• [FEATURE] Add "isolated" metric on cpu collector on linux
• [FEATURE] Add cgroup summary collector
• [FEATURE] Add selinux collector
• [FEATURE] Add slab info collector
• [FEATURE] Add sysctl collector
• [FEATURE] Also track the CPU Spin time for OpenBSD systems
• [FEATURE] Add support for MacOS version
• [ENHANCEMENT] Add RTNL version of netclass collector
• [ENHANCEMENT] [node-mixin] Add missing selectors
• [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default
• [ENHANCEMENT] [node-mixin] Change disk graph to disk table
• [ENHANCEMENT] [node-mixin] Change io time units to %util
• [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd
• [ENHANCEMENT] Add additional vm_stat memory metrics for darwin
• [ENHANCEMENT] Add device filter flags to arp collector
• [ENHANCEMENT] Add diskstats include and exclude device flags
• [ENHANCEMENT] Add node_softirqs_total metric
• [ENHANCEMENT] Add rapl zone name label option
• [ENHANCEMENT] Add slabinfo collector
• [ENHANCEMENT] Allow user to select port on NTP server to query
• [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev
• [ENHANCEMENT] Enable builds against older macOS SDK
• [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name
• [ENHANCEMENT] systemd: Expose systemd minor version
• [ENHANCEMENT] Use netlink for tcpstat collector
• [ENHANCEMENT] Use netlink to get netdev stats
• [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles
• [ENHANCEMENT] Add btrfs device error stats
• Change build requirement to go1.18 or higher (previously this was fixed to version 1.14)

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4
  zypper in -t patch openSUSE-SLE-15.4-2023-2187=1
• SUSE Manager Client Tools for SLE 15
  zypper in -t patch SUSE-SLE-Manager-Tools-15-2023-2187=1
• SUSE Manager Client Tools for SLE Micro 5
  zypper in -t patch SUSE-SLE-Manager-Tools-For-Micro-5-2023-2187=1
• Basesystem Module 15-SP4
  zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-2187=1
• SUSE Manager Proxy 4.2 Module 4.2
  zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.2-2023-2187=1
• SUSE Manager Proxy 4.3 Module 4.3
  zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2023-2187=1
• SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2023-2187=1
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2023-2187=1
• SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-2187=1
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP3
  zypper in -t patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-2187=1
• SUSE Linux Enterprise Real Time 15 SP3
  zypper in -t patch SUSE-SLE-Product-RT-15-SP3-2023-2187=1
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2023-2187=1
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2023-2187=1
• SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3
  zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-2187=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP1
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP1-2023-2187=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP2
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2023-2187=1
• SUSE Linux Enterprise Server for SAP Applications 15 SP3
  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-2187=1
• SUSE Manager Proxy 4.2
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.2-2023-2187=1
• SUSE Manager Retail Branch Server 4.2
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.2-2023-2187=1
• SUSE Manager Server 4.2
  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.2-2023-2187=1
• SUSE Enterprise Storage 7.1
  zypper in -t patch SUSE-Storage-7.1-2023-2187=1
• SUSE Enterprise Storage 7
  zypper in -t patch SUSE-Storage-7-2023-2187=1
• SUSE CaaS Platform 4.0
  To install this update, use the SUSE CaaS Platform 'skuba' tool. It will inform you if it detects new updates and let you then trigger updating of the complete cluster in a controlled way.

Package List:

• openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-alertmanager-0.23.0-150100.4.13.2
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-alertmanager-0.23.0-150100.4.13.2
• SUSE Manager Client Tools for SLE Micro 5 (aarch64 s390x x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Manager Proxy 4.2 Module 4.2 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-alertmanager-0.23.0-150100.4.13.2
• SUSE Manager Proxy 4.3 Module 4.3 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-alertmanager-0.23.0-150100.4.13.2
• SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (aarch64 x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise Real Time 15 SP3 (x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise Server for SAP Applications 15 SP1 (ppc64le x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Manager Proxy 4.2 (x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Manager Retail Branch Server 4.2 (x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Manager Server 4.2 (ppc64le s390x x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Enterprise Storage 7.1 (aarch64 x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE Enterprise Storage 7 (aarch64 x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2
• SUSE CaaS Platform 4.0 (x86_64)
  • golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2

References:

• https://www.suse.com/security/cve/CVE-2022-27191.html
• https://www.suse.com/security/cve/CVE-2022-27664.html
• https://www.suse.com/security/cve/CVE-2022-46146.html
• https://bugzilla.suse.com/show_bug.cgi?id=1197284
• https://bugzilla.suse.com/show_bug.cgi?id=1203185
• https://bugzilla.suse.com/show_bug.cgi?id=1208051
• https://bugzilla.suse.com/show_bug.cgi?id=1208064
• https://jira.suse.com/browse/PED-3578