ID de Prueba:	1.3.6.1.4.1.25623.1.0.856483
Categoría:	openSUSE Local Security Checks
Título:	openSUSE Security Advisory (SUSE-SU-2024:3288-1)
Resumen:	The remote host is missing an update for the 'golang-github-prometheus-prometheus' package(s) announced via the SUSE-SU-2024:3288-1 advisory.
Descripción:	Summary: The remote host is missing an update for the 'golang-github-prometheus-prometheus' package(s) announced via the SUSE-SU-2024:3288-1 advisory. Vulnerability Insight: This update for golang-github-prometheus-prometheus fixes the following issues: - Require Go > 1.20 for building - Bump go-retryablehttp to version 0.7.7 (CVE-2024-6104, bsc#1227038) - Migrate from `disabled` to `manual` service mode - Add0003-Bump-go-retryablehttp.patch - Update to 2.45.6 (jsc#PED-3577): * Security fixes in dependencies - Update to 2.45.5: * [BUGFIX] tsdb/agent: ensure that new series get written to WAL on rollback. * [BUGFIX] Remote write: Avoid a race condition when applying configuration. - Update to 2.45.4: * [BUGFIX] Remote read: Release querier resources before encoding the results. - Update to 2.45.3: * Security fixes in dependencies * [BUGFIX] TSDB: Remove double memory snapshot on shutdown. - Update to 2.45.2: * Security fixes in dependencies * [SECURITY] Updated otelhttp to version 0.46.1 (CVE-2023-45142, bsc#1228556) * [BUGFIX] TSDB: Fix PostingsForMatchers race with creating new series. - Update to 2.45.1: * [ENHANCEMENT] Hetzner SD: Support larger ID's that will be used by Hetzner in September. * [BUGFIX] Linode SD: Cast InstanceSpec values to int64 to avoid overflows on 386 architecture. * [BUGFIX] TSDB: Handle TOC parsing failures. - update to 2.45.0 (jsc#PED-5406): * [FEATURE] API: New limit parameter to limit the number of items returned by `/api/v1/status/tsdb` endpoint. * [FEATURE] Config: Add limits to global config. * [FEATURE] Consul SD: Added support for `path_prefix`. * [FEATURE] Native histograms: Add option to scrape both classic and native histograms. * [FEATURE] Native histograms: Added support for two more arithmetic operators `avg_over_time` and `sum_over_time`. * [FEATURE] Promtool: When providing the block id, only one block will be loaded and analyzed. * [FEATURE] Remote-write: New Azure ad configuration to support remote writing directly to Azure Monitor workspace. * [FEATURE] TSDB: Samples per chunk are now configurable with flag `storage.tsdb.samples-per-chunk`. By default set to its former value 120. * [ENHANCEMENT] Native histograms: bucket size can now be limited to avoid scrape fails. * [ENHANCEMENT] TSDB: Dropped series are now deleted from the WAL sooner. * [BUGFIX] Native histograms: ChunkSeries iterator now checks if a new sample can be appended to the open chunk. * [BUGFIX] Native histograms: Fix Histogram Appender `Appendable()` segfault. * [BUGFIX] Native histograms: Fix setting reset header to gauge histograms in seriesToChunkEncoder. * [BUGFIX] TSDB: Tombstone intervals are not modified after Get() call. * [BUGFIX] TSDB: Use path/filepath to set the WAL directory. - update to 2.44.0: * [FEATURE] Remote-read: Handle native histograms. * [FEATURE] Promtool: Health and readiness check of prometheus server in CLI. * [FEATURE] PromQL: Add `query_samples_total` metric, the total number of samples loaded by all queries. * [ENHANCEMENT] Storage: Optimise ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'golang-github-prometheus-prometheus' package(s) on openSUSE Leap 15.5, openSUSE Leap 15.6. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2022-41715 https://security.gentoo.org/glsa/202311-09 https://go.dev/cl/439356 https://go.dev/issue/55949 https://groups.google.com/g/golang-announce/c/xtuG5faxtaU https://pkg.go.dev/vuln/GO-2022-1039 Common Vulnerability Exposure (CVE) ID: CVE-2022-41723 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T7N5GV4CHH6WAGX3GFMDD3COEOVCZ4RI/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/REMHVVIBDNKSRKNOTV7EQSB7CYQWOUOU/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BUK2ZIAGCULOOYDNH25JPU6JBES5NF2/ https://www.couchbase.com/alerts/ https://go.dev/cl/468135 https://go.dev/cl/468295 https://go.dev/issue/57855 https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4MA5XS5DAOJ5PKKNG5TUXKPQOFHT5VBC/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGW7GE2Z32ZT47UFAQFDRQE33B7Q7LMT/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLBQ3A7ROLEQXQLXFDLNJ7MYPKG5GULE/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XX3IMUTZKRQ73PBZM4E2JP4BKYH4C6XE/ https://pkg.go.dev/vuln/GO-2023-1571 Common Vulnerability Exposure (CVE) ID: CVE-2023-45142 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD/ https://github.com/advisories/GHSA-cg3q-j54f-5p7p https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65 https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277 https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0 https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223 https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159 Common Vulnerability Exposure (CVE) ID: CVE-2024-6104 https://discuss.hashicorp.com/c/security
Copyright	Copyright (C) 2024 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.