{"id":"SUSE-SU-2023:2187-1","summary":"Security update for Prometheus Golang clients","details":"This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- Security issues fixed:\n  * CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)   \n    \ngolang-github-prometheus-node_exporter:\n\n- Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):\n  * CVE-2022-27191: Update go/x/crypto (bsc#1197284)\n  * CVE-2022-27664: Update go/x/net (bsc#1203185)\n  * CVE-2022-46146: Update exporter-toolkit (bsc#1208064)\n- Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578):\n  * NOTE: This changes the Go runtime 'GOMAXPROCS' to 1. This is done to limit the concurrency of the exporter to 1 CPU\n    thread at a time in order to avoid a race condition problem in the Linux kernel and parallel IO issues on nodes with\n    high numbers of CPUs/CPU threads.\n  * [BUGFIX] Fix hwmon label sanitizer\n  * [BUGFIX] Use native endianness when encoding InetDiagMsg\n  * [BUGFIX] Fix btrfs device stats always being zero\n  * [BUGFIX] Fix diskstats exclude flags\n  * [BUGFIX] [node-mixin] Fix fsSpaceAvailableCriticalThreshold and fsSpaceAvailableWarning\n  * [BUGFIX] Fix concurrency issue in ethtool collector\n  * [BUGFIX] Fix concurrency issue in netdev collector\n  * [BUGFIX] Fix diskstat reads and write metrics for disks with different sector sizes\n  * [BUGFIX] Fix iostat on macos broken by deprecation warning\n  * [BUGFIX] Fix NodeFileDescriptorLimit alerts\n  * [BUGFIX] Sanitize rapl zone names\n  * [BUGFIX] Add file descriptor close safely in test\n  * [BUGFIX] Fix race condition in os_release.go\n  * [BUGFIX] Skip ZFS IO metrics if their paths are missing\n  * [BUGFIX] Handle nil CPU thermal power status on M1\n  * [BUGFIX] bsd: Ignore filesystems flagged as MNT_IGNORE\n  * [BUGFIX] Sanitize UTF-8 in dmi collector\n  * [CHANGE] Merge metrics descriptions in textfile collector\n  * [FEATURE] Add multiple listeners and systemd socket listener activation\n  * [FEATURE] [node-mixin] Add darwin dashboard to mixin\n  * [FEATURE] Add 'isolated' metric on cpu collector on linux\n  * [FEATURE] Add cgroup summary collector\n  * [FEATURE] Add selinux collector\n  * [FEATURE] Add slab info collector\n  * [FEATURE] Add sysctl collector\n  * [FEATURE] Also track the CPU Spin time for OpenBSD systems\n  * [FEATURE] Add support for MacOS version\n  * [ENHANCEMENT] Add RTNL version of netclass collector\n  * [ENHANCEMENT] [node-mixin] Add missing selectors\n  * [ENHANCEMENT] [node-mixin] Change current datasource to grafana's default\n  * [ENHANCEMENT] [node-mixin] Change disk graph to disk table\n  * [ENHANCEMENT] [node-mixin] Change io time units to %util\n  * [ENHANCEMENT] Ad user_wired_bytes and laundry_bytes on *bsd\n  * [ENHANCEMENT] Add additional vm_stat memory metrics for darwin\n  * [ENHANCEMENT] Add device filter flags to arp collector\n  * [ENHANCEMENT] Add diskstats include and exclude device flags\n  * [ENHANCEMENT] Add node_softirqs_total metric\n  * [ENHANCEMENT] Add rapl zone name label option\n  * [ENHANCEMENT] Add slabinfo collector\n  * [ENHANCEMENT] Allow user to select port on NTP server to query\n  * [ENHANCEMENT] collector/diskstats: Add labels and metrics from udev\n  * [ENHANCEMENT] Enable builds against older macOS SDK\n  * [ENHANCEMENT] qdisk-linux: Add exclude and include flags for interface name\n  * [ENHANCEMENT] systemd: Expose systemd minor version\n  * [ENHANCEMENT] Use netlink for tcpstat collector\n  * [ENHANCEMENT] Use netlink to get netdev stats\n  * [ENHANCEMENT] Add additional perf counters for stalled frontend/backend cycles\n  * [ENHANCEMENT] Add btrfs device error stats\n- Change build requirement to go1.18 or higher (previously this was fixed to version 1.14)\n","modified":"2026-03-11T07:23:07.168618Z","published":"2023-05-11T17:02:04Z","related":["CVE-2022-27191","CVE-2022-27664","CVE-2022-46146"],"upstream":["CVE-2022-27191","CVE-2022-27664","CVE-2022-46146"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232187-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1197284"},{"type":"REPORT","url":"https://bugzilla.suse.com/1203185"},{"type":"REPORT","url":"https://bugzilla.suse.com/1208051"},{"type":"REPORT","url":"https://bugzilla.suse.com/1208064"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-27191"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-27664"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2022-46146"}],"affected":[{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"SUSE:Manager Client Tools 15","purl":"pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Client%20Tools%2015"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-150100.4.13.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.23.0-150100.4.13.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Client%20Tools%20for%20SLE%20Micro%205"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"SUSE:Manager Proxy Module 4.2","purl":"pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Proxy%20Module%204.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-150100.4.13.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.23.0-150100.4.13.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"SUSE:Manager Proxy Module 4.3","purl":"pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Proxy%20Module%204.3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-150100.4.13.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.23.0-150100.4.13.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Manager Proxy 4.2","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Proxy%204.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Manager Server 4.2","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Server%204.2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Enterprise Storage 7","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Enterprise%20Storage%207"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Enterprise Storage 7.1","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Enterprise%20Storage%207.1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/golang-github-prometheus-alertmanager&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0-150100.4.13.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2","golang-github-prometheus-alertmanager":"0.23.0-150100.4.13.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/golang-github-prometheus-node_exporter&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-150100.3.23.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.23.0-150100.4.13.2","golang-github-prometheus-node_exporter":"1.5.0-150100.3.23.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2187-1.json"}}],"schema_version":"1.7.5"}