Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 2 articles for you...
202
security advisorymoderatedenial of serviceopenSUSE 16.0 golang-github-prometheus-alertmanager Update 2026-21136-1
An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.. openSUSE security update: security update for golang-github-prometheus-alertmanager ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21136-1 Rating: moderate References: * bsc#1236516 * bsc#1238686 * bsc#1247748 Cross-References: * CVE-2023-45288 * CVE-2025-22870 * CVE-2025-47908 CVSS scores: * CVE-2023-45288 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2023-45288 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-22870 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L * CVE-2025-22870 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-47908 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-47908 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed. Description: This update for golang-github-prometheus-alertmanager fixes the following issues: Changes in golang-github-prometheus-alertmanager: - Update to version 0.28.1 (jsc#PED-13285): * Improved performance of inhibition rules when using Equal labels. * Improve the documentation on escaping in UTF-8 matchers. * Update alertmanager_config_hash metric help to document the hash is not cryptographically strong. * Fix panic in amtool when using --verbose. * Fix templating of channel field for Rocket.Chat. * Fix rocketchat_configs written as rocket_configs in docs. * Fix usage for --enable-feature flag. * Trim whitespace from OpsGenie API Key. * Fix Jira project template not rendered when searching for existing issues. * Fix subtle bug in JSON/YAML encoding of inhibition rules that would cause Equal labels to be omitted. * Fixheader for slack_configs in docs. * Fix weight and wrap of Microsoft Teams notifications. - Upgrade to version 0.28.0: * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748). * Templating errors in the SNS integration now return an error. * Adopt log/slog, drop go-kit/log. * Add a new Microsoft Teams integration based on Flows. * Add a new Rocket.Chat integration. * Add a new Jira integration. * Add support for GOMEMLIMIT, enable it via the feature flag --enable-feature=auto-gomemlimit. * Add support for GOMAXPROCS, enable it via the feature flag --enable-feature=auto-gomaxprocs. * Add support for limits of silences including the maximum number of active and pending silences, and the maximum size per silence (in bytes). You can use the flags --silences.max-silences and --silences.max-silence-size-bytes to set them accordingly. * Muted alerts now show whether they are suppressed or not in both the /api/v2/alerts endpoint and the Alertmanager UI. - Upgrade to version 0.27.0: * API: Removal of all api/v1/ endpoints. These endpoints now log and return a deprecation message and respond with a status code of 410. * UTF-8 Support: Introduction of support for any UTF-8 character as part of label names and matchers. * Discord Integration: Enforce max length in message. * Metrics: Introduced the experimental feature flag --enable-feature=receiver-name-in-metrics to include the receiver name. * Metrics: Introduced a new gauge named alertmanager_inhibition_rules that counts the number of configured inhibition rules. * Metrics: Introduced a new counter named alertmanager_alerts_supressed_total that tracks muted alerts, it contains a reason label to indicate the source of the mute. * Discord Integration: Introduced support for webhook_url_file. * Microsoft Teams Integration: Introduced support for webhook_url_file. * Microsoft Teams Integration: Add support for summary. * Metrics: Notification metrics now supporttwo new values for the label reason, contextCanceled and contextDeadlineExceeded. * Email Integration: Contents of auth_password_file are now trimmed of prefixed and suffixed whitespace. * amtool: Fixes the error scheme required for webhook url when using amtool with --alertmanager.url. * Mixin: Fix AlertmanagerFailedToSendAlerts, AlertmanagerClusterFailedToSendAlerts, and AlertmanagerClusterFailedToSendAlerts to make sure they ignore the reason label. - Security: * Fix proxy bypassing using IPv6 zone IDs (CVE-2025-22870, bsc#1238686) * Fix HTTP/2 CONTINUATION flood in net/http (CVE-2023-45288, bsc#1236516) * Add 0002-Bump-x-net.patch Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-packagehub-331=1 Package List: - openSUSE Leap 16.0: golang-github-prometheus-alertmanager-0.28.1-bp160.1.1 References: * https://www.suse.com/security/cve/CVE-2023-45288.html * https://www.suse.com/security/cve/CVE-2025-22870.html * https://www.suse.com/security/cve/CVE-2025-47908.html . This openSUSE update for golang-github-prometheus-alertmanager addresses multiple security issues, ensuring system stability and safety.. openSUSE security update, golang alertmanager, vulnerability patch, system updates. . Severity: moderate. LinuxSecurity.com Team
Jun 30, 2026
•moderate
OpenSUSE
89
security advisorydenial of servicefedoraFedora 43 Alertmanager Important DoS Fix 2026-1ad4561f49
Update to 0.33.0. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-1ad4561f49 2026-06-21 01:09:26.438236+00:00 -------------------------------------------------------------------------------- Name : alertmanager Product : Fedora 43 Version : 0.33.0 Release : 1.fc43 URL : https://github.com/prometheus/alertmanager Summary : Prometheus Alertmanager Description : The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. -------------------------------------------------------------------------------- Update Information: Update to 0.33.0 -------------------------------------------------------------------------------- ChangeLog: * Fri Jun 12 2026 Mikel Olasagasti Uranga - 0.33.0-1 - Update to 0.33.0 - Closes rhbz#2485517 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2486249 - CVE-2026-45287 alertmanager: OpenTelemetry-Go: Denial of Service due to file descriptor leak [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2486249 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1ad4561f49' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 20, 2026
•Important
Fedora
89
security advisorydenial of servicefedoraFedora 44 Alertmanager Important Denial of Service Fix 2026-87b103f151
Update to 0.33.0. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-87b103f151 2026-06-21 00:58:50.478393+00:00 -------------------------------------------------------------------------------- Name : alertmanager Product : Fedora 44 Version : 0.33.0 Release : 1.fc44 URL : https://github.com/prometheus/alertmanager Summary : Prometheus Alertmanager Description : The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. -------------------------------------------------------------------------------- Update Information: Update to 0.33.0 -------------------------------------------------------------------------------- ChangeLog: * Fri Jun 12 2026 Mikel Olasagasti Uranga - 0.33.0-1 - Update to 0.33.0 - Closes rhbz#2485517 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2486249 - CVE-2026-45287 alertmanager: OpenTelemetry-Go: Denial of Service due to file descriptor leak [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2486249 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-87b103f151' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Jun 20, 2026
•Important
Fedora
89
security advisoryfedoraimportantFedora 43 alertmanager 0.31.1 Important Updates 2026-efbceeec2f
Initial build after rename and update to 0.31.1. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-efbceeec2f 2026-03-16 00:57:17.182013+00:00 -------------------------------------------------------------------------------- Name : alertmanager Product : Fedora 43 Version : 0.31.1 Release : 2.fc43 URL : https://github.com/prometheus/alertmanager Summary : Prometheus Alertmanager Description : The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. -------------------------------------------------------------------------------- Update Information: Initial build after rename and update to 0.31.1 -------------------------------------------------------------------------------- ChangeLog: * Fri Mar 6 2026 Mikel Olasagasti Uranga - 0.31.1-1 - Initial package after rename - Closes rhbz#2444340 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2408246 - CVE-2025-58189 golang-github-prometheus-alertmanager: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2408246 [ 2 ] Bug #2408713 - CVE-2025-61725 golang-github-prometheus-alertmanager: Excessive CPU consumption in ParseAddress in net/mail [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2408713 [ 3 ] Bug #2409717 - CVE-2025-61723 golang-github-prometheus-alertmanager: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2409717 [ 4 ] Bug #2410670 - CVE-2025-58185 golang-github-prometheus-alertmanager: Parsing DER payload can cause memory exhaustion inencoding/asn1 [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2410670 [ 5 ] Bug #2411566 - CVE-2025-58188 golang-github-prometheus-alertmanager: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2411566 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-efbceeec2f' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Mar 16, 2026
•Important
Fedora
89
security advisorydenial of servicefedoraFedora 42 alertmanager Critical Denial Of Service Vulnerability Report
Initial build after rename and update to 0.31.1. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-83937af369 2026-03-15 01:12:21.661907+00:00 -------------------------------------------------------------------------------- Name : alertmanager Product : Fedora 42 Version : 0.31.1 Release : 2.fc42 URL : https://github.com/prometheus/alertmanager Summary : Prometheus Alertmanager Description : The Alertmanager handles alerts sent by client applications such as the Prometheus server. It takes care of deduplicating, grouping, and routing them to the correct receiver integrations such as email, PagerDuty, or OpsGenie. It also takes care of silencing and inhibition of alerts. -------------------------------------------------------------------------------- Update Information: Initial build after rename and update to 0.31.1 -------------------------------------------------------------------------------- ChangeLog: * Fri Mar 6 2026 Mikel Olasagasti Uranga - 0.31.1-1 - Initial package after rename - Closes rhbz#2444340 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2398777 - CVE-2025-47910 golang-github-prometheus-alertmanager: CrossOriginProtection bypass in net/http [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2398777 [ 2 ] Bug #2399448 - CVE-2025-47906 golang-github-prometheus-alertmanager: Unexpected paths returned from LookPath in os/exec [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2399448 [ 3 ] Bug #2407978 - CVE-2025-58189 golang-github-prometheus-alertmanager: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2407978 [ 4 ] Bug #2408653 - CVE-2025-61725 golang-github-prometheus-alertmanager: Excessive CPU consumption in ParseAddress in net/mail [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2408653 [ 5 ] Bug #2409448 - CVE-2025-61723 golang-github-prometheus-alertmanager: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2409448 [ 6 ] Bug #2410399 - CVE-2025-58185 golang-github-prometheus-alertmanager: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2410399 [ 7 ] Bug #2411299 - CVE-2025-58188 golang-github-prometheus-alertmanager: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-42] https://bugzilla.redhat.com/show_bug.cgi?id=2411299 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-83937af369' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Mar 15, 2026
•Critical
Fedora
100
security advisorymoderatesecurity issueSUSE: 2025:01992-1 moderate: golang-github-prometheus-alertmanager
* bsc#1236516 * bsc#1238686 * jsc#MSQA-992 Cross-References: . # Security update for golang-github-prometheus-alertmanager Announcement ID: SUSE-SU-2025:01992-1 Release Date: 2025-06-18T02:13:13Z Rating: moderate References: * bsc#1236516 * bsc#1238686 * jsc#MSQA-992 Cross-References: * CVE-2023-45288 * CVE-2025-22870 CVSS scores: * CVE-2023-45288 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2023-45288 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2025-22870 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N * CVE-2025-22870 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L * CVE-2025-22870 ( NVD ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * openSUSE Leap 15.6 * SUSE Linux Enterprise Desktop 15 * SUSE Linux Enterprise Desktop 15 SP1 * SUSE Linux Enterprise Desktop 15 SP2 * SUSE Linux Enterprise Desktop 15 SP3 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Real Time 15 SP1 * SUSE Linux Enterprise Real Time 15 SP2 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Real Time 15 SP6 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux EnterpriseServer 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Manager Client Tools for SLE 15 * SUSE Manager Proxy 4.3 * SUSE Manager Proxy 4.3 Module * SUSE Manager Retail Branch Server 4.3 * SUSE Package Hub 15 15-SP6 * SUSE Package Hub 15 15-SP7 An update that solves two vulnerabilities and contains one feature can now be installed. ## Description: This update for golang-github-prometheus-alertmanager fixes the following issues: * Security: * CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238686) * CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516) ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2025-1992=1 * SUSE Manager Client Tools for SLE 15 zypper in -t patch SUSE-SLE-Manager-Tools-15-2025-1992=1 * SUSE Package Hub 15 15-SP6 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-1992=1 * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-1992=1 * SUSE Manager Proxy 4.3 Module zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2025-1992=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) *golang-github-prometheus-alertmanager-debuginfo-0.26.0-150100.4.25.2 * golang-github-prometheus-alertmanager-0.26.0-150100.4.25.2 * SUSE Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.25.2 * SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-debuginfo-0.26.0-150100.4.25.2 * golang-github-prometheus-alertmanager-0.26.0-150100.4.25.2 * SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-debuginfo-0.26.0-150100.4.25.2 * golang-github-prometheus-alertmanager-0.26.0-150100.4.25.2 * SUSE Manager Proxy 4.3 Module (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.25.2 ## References: * https://www.suse.com/security/cve/CVE-2023-45288.html * https://www.suse.com/security/cve/CVE-2025-22870.html * https://bugzilla.suse.com/show_bug.cgi?id=1236516 * https://bugzilla.suse.com/show_bug.cgi?id=1238686 * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FMSQA-992&page_caps=&user_role= . Address medium security vulnerabilities in golang-github-prometheus-alertmanager for SUSE distributions with this patch.. SUSE, alertmanager, golang, update, security fix. . LinuxSecurity.com Team
Jun 18, 2025
SuSE
100
security advisorysecurity updateimportantSUSE: 2024:0512-1 Important: Golang Alertmanager XSS Issue Fix
* bsc#1218838 * jsc#MSQA-719 * jsc#PED-7353 Cross-References: . # Security update for golang-github-prometheus-alertmanager Announcement ID: SUSE-SU-2024:0512-1 Rating: important References: * bsc#1218838 * jsc#MSQA-719 * jsc#PED-7353 Cross-References: * CVE-2023-40577 CVSS scores: * CVE-2023-40577 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2023-40577 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Affected Products: * openSUSE Leap 15.3 * openSUSE Leap 15.4 * openSUSE Leap 15.5 * SUSE Linux Enterprise Desktop 15 * SUSE Linux Enterprise Desktop 15 SP1 * SUSE Linux Enterprise Desktop 15 SP2 * SUSE Linux Enterprise Desktop 15 SP3 * SUSE Linux Enterprise Desktop 15 SP4 * SUSE Linux Enterprise Desktop 15 SP5 * SUSE Linux Enterprise Desktop 15 SP6 * SUSE Linux Enterprise High Performance Computing 15 * SUSE Linux Enterprise High Performance Computing 15 SP1 * SUSE Linux Enterprise High Performance Computing 15 SP2 * SUSE Linux Enterprise High Performance Computing 15 SP3 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing 15 SP6 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP1 * SUSE Linux Enterprise Real Time 15 SP2 * SUSE Linux Enterprise Real Time 15 SP3 * SUSE Linux Enterprise Real Time 15 SP4 * SUSE Linux Enterprise Real Time 15 SP5 * SUSE Linux Enterprise Server 15 * SUSE Linux Enterprise Server 15 SP1 * SUSE Linux Enterprise Server 15 SP2 * SUSE Linux Enterprise Server 15 SP3 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 * SUSE Linux Enterprise Server for SAP Applications 15 SP1 * SUSE Linux Enterprise Server for SAP Applications 15 SP2 * SUSE Linux Enterprise Server for SAP Applications 15 SP3 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE LinuxEnterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Manager Client Tools for SLE 15 * SUSE Manager Proxy 4.3 * SUSE Manager Proxy 4.3 Module 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Package Hub 15 15-SP5 An update that solves one vulnerability and contains two features can now be installed. ## Description: This update for golang-github-prometheus-alertmanager fixes the following issues: golang-github-prometheus-alertmanager was updated from version 0.23.0 to 0.26.0 (jsc#PED-7353): * Version 0.26.0: * Security fixes: * CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838) * Other changes and bugs fixed: * Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash * Templating: Fixed a race condition when using the title function. It is now race-safe * API: Fixed duplicate receiver names in the api/v2/receivers API endpoint * API: Attempting to delete a silence now returns the correct status code, 404 instead of 500 * Clustering: Fixes a panic when tls_client_config is empty * Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text * Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery * Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster * Integrations: Add Microsoft Teams as a supported integration * Version 0.25.0: * Fail configuration loading if api_key and api_key_file are defined at the same time * Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior * Trim contents of Slack API URLs when reading from files * amtool: Avoid panic when the label value matcher is empty * Fail configuration loading if api_url is empty for OpsGenie * Fix email template forresolved notifications * Add proxy_url support for OAuth2 in HTTP client configuration * Reload TLS certificate and key from disk when updated * Add Discord integration * Add Webex integration * Add min_version support to select the minimum TLS version in HTTP client configuration * Add max_version support to select the maximum TLS version in HTTP client configuration * Emit warning logs when truncating messages in notifications * Support HEAD method for the /-/healty and /-/ready endpoints * Add support for reading global and local SMTP passwords from files * UI: Add 'Link' button to alerts in list * UI: Allow to choose the first day of the week as Sunday or Monday * Version 0.24.0: * Fix HTTP client configuration for the SNS receiver * Fix unclosed file descriptor after reading the silences snapshot file * Fix field names for mute_time_intervals in JSON marshaling * Ensure that the root route doesn't have any matchers * Truncate the message's title to 1024 chars to avoid hitting Slack limits * Fix the default HTML email template (email.default.html) to match with the canonical source * Detect SNS FIFO topic based on the rendered value * Avoid deleting and recreating a silence when an update is possible * api/v2: Return 200 OK when deleting an expired silence * amtool: Fix the silence's end date when adding a silence. The end date is (start date + duration) while it used to be (current time + duration). The new behavior is consistent with the update operation * Add the /api/v2 prefix to all endpoints in the OpenAPI specification and generated client code * Add --cluster.tls-config experimental flag to secure cluster traffic via mutual TLS * Add Telegram integration ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Manager Proxy 4.3 Module 4.3 zypper in -t patch SUSE-SLE-Module-SUSE-Manager-Proxy-4.3-2024-512=1 *openSUSE Leap 15.5 zypper in -t patch openSUSE-SLE-15.5-2024-512=1 * SUSE Manager Client Tools for SLE 15 zypper in -t patch SUSE-SLE-Manager-Tools-15-2024-512=1 * SUSE Package Hub 15 15-SP5 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-512=1 ## Package List: * SUSE Manager Proxy 4.3 Module 4.3 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 * openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 * SUSE Manager Client Tools for SLE 15 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 * SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64) * golang-github-prometheus-alertmanager-0.26.0-150100.4.19.1 ## References: * https://www.suse.com/security/cve/CVE-2023-40577.html * https://bugzilla.suse.com/show_bug.cgi?id=1218838 * * . Essential SUSE enhancement for golang-github-prometheus-alertmanager tackling a significant XSS vulnerability through an updated version.. SUSE Update, Golang Security, Prometheus Alertmanager, XSS Fix. . Severity: Important. LinuxSecurity.com Team
Feb 15, 2024
•Important
SuSE
197
security advisorydebianxssDebian LTS: DLA-3609-1 Critical: Prometheus Alertmanager XSS Risk
prometheus-alertmanager package, a component of Prometheus, an application used for event monitoring and alerting, was vulnerable to stored XSS type attack. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3609-1
Oct 08, 2023
•Critical
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!