Attestkeep
Langue : Français
S'inscrire

Vulnérabilités / SUSE-SU-2026:2243-1

critique

SUSE-SU-2026:2243-1

Security update 5.0.8 for Multi-Linux Manager Client Tools

Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.

Sévérité par source

Aucune source ne donne de score CVSS.

Le label propre à Trivy est CRITICAL. Critique selon SUSE.

Description

This update fixes the following issues: golang-github-QubitProducts-exporter_exporter: - Security Fixes: - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248707) golang-github-prometheus-node_exporter: - Backward Compatibility and packaging changes: - Added compatibility for Go 1.22/1.23 needed in older RHEL toolchains - Pinned golang.org/x/net to v0.37.0 for Go 1.22 compatibility - Version 1.10.2: - Fixed typo in Zswap metric name (meminfo) - Version 1.10.1: - Fixed mount points being collected multiple times (filesystem) - Refactored mountinfo parsing (bsc#1261810) - Added Zswap/Zswapped metrics (meminfo) - Version 1.10.0: - New collectors: PCIe devices, swaps - Added systemd virtualization metrics, AIX metrics - WiFi packet metrics, additional PCIe and TLB metrics - Changed mdadm to use sysfs, added erofs to excluded filesystems - Fixed bugs: cpufreq collector, ethtool metrics golang-github-prometheus-prometheus: - Security issues fixed: - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986) - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987). - CVE-2026-40179: UI: Fixed stored XSS via unescaped le label values in old UI heatmap chart tick labels (bsc#1262222) - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260267) * Bump google.golang.org/grpc to version 1.79.3 - CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893) * Bump rollup to version 4.59.0 - Other changes: - Remote-Write: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit. - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy (jsc#PED-14816) prometheus-postgres_exporter: - Security Fixes: - CVE-2026-42154: Remote-read: Reject snappy-compressed requests whose declared decoded length exceeds the decode limit (bsc#1263987) - CVE-2026-42151: AzureAD remote write: Fixed OAuth client_secret being exposed in plaintext via /-/config endpoint (bsc#1263986) - CVE-2022-21698: Fixed denial of service using InstrumentHandlerCounter (bsc#1248699) - Highlights of other changes and bug fixes: - Use systemd tmpfiles.d to create /var/lib/prometheus hierarchy grafana was updated from version 11.6.11 to 11.6.14+security01: - Security Fixes: - CVE-2026-34986: Fixed unrecoverable error in JWE decryption that could lead to a denial of service (bsc#1262950) - CVE-2026-41602: Fixed Integer Overflow or Wraparound vulnerability in Apache Thrift (bsc#1263501) - CVE-2026-26958: Ensure that MultiScalarMult properly handles initialization and produces correct results (bsc#1258595) - CVE-2026-21725: Fixed missing UID when deleting datasource by name (bsc#1258873) - CVE-2026-33375: Fixed denial of Service via out-of-memory exhaustion in MSSQL data source plugin (bsc#1260881) - CVE-2026-27876: Fixed remote arbitrary code execution via chained SQL Expressions (bsc#1261025) - CVE-2026-27877: Fixed information disclosure of data-source passwords via public dashboards (bsc#1261026) - CVE-2026-28375: Fixed denial of service via testdata data-source (bsc#1261029) - CVE-2026-27879: Fixed denial of service via resample query (bsc#1261027) - CVE-2026-33186: Fixed authorization bypass due to improper validation of the HTTP/2 :path pseudo-header (bsc#1260263) - CVE-2026-21724: Fixed authorization bypass allows modification of protected webhook URLs (bsc#1260878) - Highlights of other changes and bug fixes: - Version 11.6.13: - Wire the public dashboard service to the HTTP server - Version 11.6.12: - Update authentication redirect logic - Fixed single panel render with variable references spacecmd: - Version 5.0.16-0: - Update translation strings uyuni-tools: - Version 0.1.39-0: - mgrpxy ssh tuning should happen before crypto policies (bsc#1254619) - Fixed default value for helm registry (bsc#1258927). - Use static supportconfig name to avoid dynamic search (bsc#1257941) - Do not nest multiple tarball files and instead collect all files into one tarball (bsc#1252964) - Show where final tarball was generated (bsc#1259208)

Paquets affectés et versions corrigées

SourcePaquetCorrigé en
SUSE Linux Enterprise 15.4golang-github-prometheus-node_exporter1.10.2-150100.3.41.2
SUSE Linux Enterprise 15.5golang-github-prometheus-node_exporter1.10.2-150100.3.41.2
SUSE Linux Enterprise 15.6golang-github-prometheus-node_exporter1.10.2-150100.3.41.2
SUSE Linux Enterprise 15.7golang-github-prometheus-node_exporter1.10.2-150100.3.41.2

Références

Les 45 références

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.