SUSE-SU-2023:0352-1: grafana&distro=SUSE Manager Client Tools 12 SUSE Linux Enterprise
Published
Published 10-02-2023Last modified 04-02-2026
Vulnerability summary
SUSE-SU-2023:0352-1 is a vulnerability in grafana&distro=SUSE Manager Client Tools 12 SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 6 · Downstream 0 · Related 6Timeline
- 10-02-2023PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Security update for SUSE Manager Client Tools This update fixes the following issues: grafana: - Update to version 8.5.15 (jsc#PED-2617): * CVE-2022-39306: Fix for privilege escalation (bsc#1205225) * CVE-2022-39307: Omit error from http response when user does not exists (bsc#1205227) - Update to version 8.5.14: * CVE-2022-39201: Fix do not forward login cookie in outgoing requests (bsc#1204303) * CVE-2022-31130: Make proxy endpoints not leak sensitive HTTP headers (bsc#1204305) * CVE-2022-31123: Fix plugin signature bypass (bsc#1204302) * CVE-2022-39229: Fix blocknig other users from signing in (bsc#1204304) kiwi-desc-saltboot: - Update to version 0.1.1673279145.e7616bd * Add failsafe stop file when salt-minion does not stop (bsc#1172110) mgr-osad: - Version 4.3.7-1 * Updated logrotate configuration (bsc#1206470) mgr-push: - Version 4.3.5-1 * Update translation strings rhnlib: - Version 4.3.5-1 * Don't get stuck at the end of SSL transfers (bsc#1204032) spacecmd: - Version 4.3.18-1 * Add python-dateutil dependency, required to process date values in spacecmd api calls - Version 4.3.17-1 * Remove python3-simplejson dependency * Correctly understand 'ssm' keyword on scap scheduling * Add vendor_advisory information to errata_details call (bsc#1205207) * Added two missing options to schedule product migration: allow-vendor-change and remove-products-without-successor (bsc#1204126) * Changed schedule product migration to use the correct API method * Change default port of 'Containerized Proxy configuration' 8022 spacewalk-client-tools: - Version 4.3.14-1 * Update translation strings uyuni-common-libs: - Version 4.3.7-1 * unify user notification code on java side
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse8 products
- grafana&distro=SUSE Manager Client Tools 12< 8.5.15-1.39.1
- kiwi-desc-saltboot&distro=SUSE Manager Client Tools 12< 0.1.1673279145.e7616bd-1.32.1
- mgr-osad&distro=SUSE Manager Client Tools 12< 4.3.7-1.42.1
- mgr-push&distro=SUSE Manager Client Tools 12< 4.3.5-1.24.1
- rhnlib&distro=SUSE Manager Client Tools 12< 4.3.5-21.46.1
- spacecmd&distro=SUSE Manager Client Tools 12< 4.3.18-38.115.1
- spacewalk-client-tools&distro=SUSE Manager Client Tools 12< 4.3.14-52.83.1
- uyuni-common-libs&distro=SUSE Manager Client Tools 12< 4.3.7-1.30.1
1 vendor · 8 products
References
18 linksShow all 18 references
Related vulnerabilities
Insufficient evidenceSUSE-SU-2025:4457-1SUSE Linux Enterprisesuse · golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12 +6 moresuse golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12Security update 5.0.6 for Multi-Linux Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-alertmanager:
- Update to version 0.28.1 (jsc#PED-13285):
* Improved performance of inhibition rules when using Equal
labels.
* Improve the documentation on escaping in UTF-8 matchers.
* Update alertmanager_config_hash metric help to document the
hash is not cryptographically strong.
* Fix panic in amtool when using --verbose.
* Fix templating of channel field for Rocket.Chat.
* Fix rocketchat_configs written as rocket_configs in docs.
* Fix usage for --enable-feature flag.
* Trim whitespace from OpsGenie API Key.
* Fix Jira project template not rendered when searching for
existing issues.
* Fix subtle bug in JSON/YAML encoding of inhibition rules that
would cause Equal labels to be omitted.
* Fix header for slack_configs in docs.
* Fix weight and wrap of Microsoft Teams notifications.
- Upgrade to version 0.28.0:
* CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).
* Templating errors in the SNS integration now return an error.
* Adopt log/slog, drop go-kit/log.
* Add a new Microsoft Teams integration based on Flows.
* Add a new Rocket.Chat integration.
* Add a new Jira integration.
* Add support for GOMEMLIMIT, enable it via the feature flag
--enable-feature=auto-gomemlimit.
* Add support for GOMAXPROCS, enable it via the feature flag
--enable-feature=auto-gomaxprocs.
* Add support for limits of silences including the maximum number
of active and pending silences, and the maximum size per
silence (in bytes). You can use the flags
--silences.max-silences and --silences.max-silence-size-bytes
to set them accordingly.
* Muted alerts now show whether they are suppressed or not in
both the /api/v2/alerts endpoint and the Alertmanager UI.
- Upgrade to version 0.27.0:
* API: Removal of all api/v1/ endpoints. These endpoints
now log and return a deprecation message and respond with a
status code of 410.
* UTF-8 Support: Introduction of support for any UTF-8
character as part of label names and matchers.
* Discord Integration: Enforce max length in message.
* Metrics: Introduced the experimental feature flag
--enable-feature=receiver-name-in-metrics to include the
receiver name.
* Metrics: Introduced a new gauge named
alertmanager_inhibition_rules that counts the number of
configured inhibition rules.
* Metrics: Introduced a new counter named
alertmanager_alerts_supressed_total that tracks muted alerts,
it contains a reason label to indicate the source of the mute.
* Discord Integration: Introduced support for webhook_url_file.
* Microsoft Teams Integration: Introduced support for
webhook_url_file.
* Microsoft Teams Integration: Add support for summary.
* Metrics: Notification metrics now support two new values for
the label reason, contextCanceled and contextDeadlineExceeded.
* Email Integration: Contents of auth_password_file are now
trimmed of prefixed and suffixed whitespace.
* amtool: Fixes the error scheme required for webhook url when
using amtool with --alertmanager.url.
* Mixin: Fix AlertmanagerFailedToSendAlerts,
AlertmanagerClusterFailedToSendAlerts, and
AlertmanagerClusterFailedToSendAlerts to make sure they ignore
the reason label.
grafana was updated from version 11.5.5 to 11.5.10:
- Security issues fixed:
* CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
* CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
* CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client
(bsc#1254113)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
* CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
* CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
* CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)
(bsc#1245302)
- Other changes, new features and bugs fixed:
* Version 11.5.10:
+ Update to Go 1.25
+ Update to golang.org/x/net v0.45.0
+ Auth: Fix render user OAuth passthrough
+ LDAP Authentication: Fix URL to propagate username context as parameter
* Version 11.5.9:
+ Auditing: Document new options for recording datasource query request/response body.
+ Login: Fixed redirection after login when Grafana is served from subpath.
* Version 11.5.7:
+ Azure: Fixed legend formatting and resource name determination in template variable queries.
mgr-push:
- Version 5.0.3-0
* Fixed syntax error in changelog
rhnlib:
- Version 5.0.6-0
* Use more secure defusedxml parser (bsc#1227577)
spacecmd:
- Version 5.0.14-0:
* Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586)
* Use JSON instead of pickle for spacecmd cache (bsc#1227579)
* Make spacecmd to work with Python 3.12 and higher
* Call print statements properly in Python 3
supportutils-plugin-susemanager-client:
- Version 5.0.5-0
* Fix syntax error in changelog
uyuni-tools:
- Version 0.1.37-0
* Handle CA files with symlinks during migration (bsc#1251044)
* Add a lowercase version of --logLevel (bsc#1243611)
* Adjust traefik exposed configuration for chart v27+ (bsc#1247721)
* Stop executing scripts in temporary folder (bsc#1243704)
* Convert the traefik install time to local time (bsc#1251138)
* Run smdba and reindex only during migration (bsc#1244534)
* Support config: collect podman inspect for hub container (bsc#1245099)
* Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry
* Deprecate --registry
* Use new dedicated path for Cobbler settings (bsc#1244027)
* Migrate custom auto installation snippets (bsc#1246320)
* Add SLE15SP7 to buildin productmap
* Fix loading product map from mgradm configuration file (bsc#1246068)
* Fix channel override for distro copy
* Do not use sudo when running as a root user (bsc#1246882)
* Do not require backups to be at the same location for restoring (bsc#1246906)
* Check for restorecon presence before calling (bsc#1246925)
* Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)
* Fix recomputing proxy images when installing a ptf or test (bsc#1246553)
* Add migration for server monitoring configuration (bsc#1247688)
- Version 0.1.36-0
* Bump the default image tag
- Version 0.1.35-0
* Restore SELinux contexts for restored backup volumes (bsc#1244127)
- Version 0.1.34-0
* Fix mgradm backup create handling of images and systemd files (bsc#1246738)
- Version 0.1.33-0
* Restore volumes using tar instead of podman import (bsc#1244127)CVSSUnscoredInsufficient evidenceSUSE-SU-2025:01987-1SUSE Linux Enterprisesuse · golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12 +6 moresuse golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12Security update for Multi-Linux Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-prometheus was updated to version 2.53.4:
- Security issues fixed:
* CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
* CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)
- Other bugs fixes from version 2.53.4:
* Runtime: fixed GOGC being set to 0 when installed
with empty prometheus.yml file resulting high cpu usage
* Scrape: fixed dropping valid metrics after previous
scrape failed
prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):
- Security issues fixed:
* CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
* CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)
- Other changes from version 0.26.0:
* Changes:
+ Replace go-kit/log with log/slog module.
* Features:
+ Add metric to record tls ciphersuite negotiated during
handshake.
+ Add a way to export labels with content matched by the probe.
Reports Certificate Serial number.
* Enhancement:
+ Add stale workflow to start sync with stale.yaml in Prometheus.
* Bug fixes:
+ Only register grpc TLS metrics on successful handshake.
- Other changes from version 0.25.0:
* Features:
+ Allow to get Probe logs by target.
+ Log errors from probe.
* Bug fixes:
+ Prevent logging confusing error message.
+ Explicit registration of internal exporter metrics.
grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):
- Security issues fixed:
* CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
* CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
* CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
* CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
* CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
* CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
* CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
* CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
* CVE-2024-9264: SQL Expressions (bsc#1231844)
* CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
* CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)
- Potential breaking changes in version 11.5.0:
* Loki: Default to /labels API with query param instead of /series API.
- Potential breaking changes in version 11.0.1:
* If you had selected your language as 'Portugu�s Brasileiro'
previously, this will be reset. You have to select it again in
your Preferences for the fix to be applied and the translations
will then be shown.
- Potential breaking changes in version 11.0.0:
* AngularJS support is turned off by default.
* Legacy alerting is entirely removed.
* Subfolders cause very rare issues with folders which have
slashes in their names.
* The input data source is removed.
* Data sources: Responses which are associated with hidden
queries will be removed (filtered) by Grafana.
* The URL which is generated when viewing an individual repeated
panel has changed.
* React Router is deprecated.
* The grafana/e2e testing tool is deprecated.
- This update brings many new features, enhancements and fixes highlighted at:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/
golang-github-prometheus-node_exporter was updated to version 1.9.1:
- Security issues fixed:
* CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)
- Other changes from version 1.9.1:
* pressure: Fix missing IRQ on older kernels
* Fix Darwin memory leak
golang-github-prometheus-alertmanager:
- Security issues fixed:
* CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238686)
* CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516)CVSSUnscoredRoutineCVE-2025-27144go-jose +692 moreGo JOSE's Parsing Vulnerable to Denial of ServiceGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.CVSS6.6MediumEPSS0.40%Insufficient evidenceSUSE-SU-2025:0622-1SUSE Linux Enterprisesuse · grafana&distro=SUSE Manager Client Tools 12suse grafana&distro=SUSE Manager Client Tools 12Security update for grafana
This update for grafana fixes the following issues:
grafana was updated from version 10.4.13 to 10.4.15:
- Security issues fixed:
* CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
* CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
* CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
* CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
- Other bugs fixed and changes:
* Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
* Added provisioning directories
* Use /bin/bash in wrapper scriptsCVSSUnscoredInsufficient evidenceSUSE-SU-2025:0524-1SUSE Linux Enterprisesuse · golang-github-prometheus-prometheus&distro=SUSE Manager Client Tools 12 +6 moresuse golang-github-prometheus-prometheus&distro=SUSE Manager Client Tools 12Security update for SUSE Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):
- Security issues fixed:
* CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error
handling (bsc#1232970)
- Highlights of other changes:
* Performance:
+ Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and
remote write operations.
+ Default GOGC value lowered to 75 for better memory management.
+ Option to limit memory usage from dropped targets added.
* New Features:
+ Experimental OpenTelemetry ingestion.
+ Automatic memory limit handling.
+ Native histogram support, including new functions, UI enhancements, and improved scraping.
+ Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.
+ Expanded service discovery options with added metadata and support for new services.
+ New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.
* Bug Fixes:
+ Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.
* For a detailed list of changes consult the package changelog or
https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3
golang-github-prometheus-promu was updated to version 0.17.0:
- Added codesign utility function
grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):
- Security issues fixed:
* CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading
golang.org/x/crypto (bsc#1234554)
* CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
* CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
* CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
* CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)
- Potential breaking changes in version 10:
* In panels using the `extract fields` transformation, where one
of the extracted names collides with one of the already
existing ields, the extracted field will be renamed.
* For the existing backend mode users who have table
visualization might see some inconsistencies on their panels.
We have updated the table column naming. This will
potentially affect field transformations and/or field
overrides. To resolve this either: update transformation or
field override.
* For the existing backend mode users who have Transformations
with the `time` field, might see their transformations are
not working. Those panels that have broken transformations
will fail to render. This is because we changed the field
key. To resolve this either: Remove the affected panel and
re-create it; Select the `Time` field again; Edit the `time`
field as `Time` for transformation in `panel.json` or
`dashboard.json`
* The following data source permission endpoints have been removed:
`GET /datasources/:datasourceId/permissions`
`POST /api/datasources/:datasourceId/permissions`
`DELETE /datasources/:datasourceId/permissions`
`POST /datasources/:datasourceId/enable-permissions`
`POST /datasources/:datasourceId/disable-permissions`
+ Please use the following endpoints instead:
`GET /api/access-control/datasources/:uid` for listing data
source permissions
`POST /api/access-control/datasources/:uid/users/:id`,
`POST /api/access-control/datasources/:uid/teams/:id` and
`POST /api/access-control/datasources/:uid/buildInRoles/:id`
for adding or removing data source permissions
* If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your
provider.
* For the existing backend mode users who have table visualization might see some inconsistencies on their panels.
We have updated the table column naming. This will potentially affect field transformations and/or field overrides.
* The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed.
Dashboard information can be retrieved from the `/dashboard/...` APIs.
* The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`
* Removed all components for the old panel header design.
* Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/
for more details
* OAuth role mapping enforcement: This change impacts GitHub,
Gitlab, Okta, and Generic OAuth. To avoid overriding manually
set roles, enable the skip_org_role_sync option in the
Grafana configuration for your OAuth provider before
upgrading
* Angular has been deprecated
* Grafana legacy alerting has been deprecated
* API keys are migrating to service accounts
* The experimental “dashboard previews” feature is removed
* Usernames are now case-insensitive by default
* Grafana OAuth integrations do not work anymore with email lookups
* The “Alias” field in the CloudWatch data source is removed
* Athena data source plugin must be updated to version >=2.9.3
* Redshift data source plugin must be updated to version >=1.8.3
* DoiT International BigQuery plugin no longer supported
* Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0
for more details
- This update brings many new features, enhancements and fixes highlighted at:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/
spacecmd was updated to version 5.0.11-0:
- Updated translation strings
supportutils-plugin-salt was updated to version 1.2.3:
- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)
- Provide backwards-compatible scripts version
supportutils-plugin-susemanager-client was updated to version 5.0.4-0:
- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)
uyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:
- Security issues fixed:
* CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)
- Other changes and bugs fixed:
* Version 0.1.27-0
+ Bump the default image tag to 5.0.3
+ IsInstalled function fix
+ Run systemctl daemon-reload after changing the container image config (bsc#1233279)
+ Coco-replicas-upgrade
+ Persist search server indexes (bsc#1231759)
+ Sync deletes files during migration (bsc#1233660)
+ Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)
+ Add --registry back to mgrpxy (bsc#1233202)
+ Only add java.hostname on migrated server if not present
+ Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)
+ Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)
+ Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)
* Version 0.1.26-0
+ Ignore all zypper caches during migration (bsc#1232769)
+ Use the uyuni network for all podman containers (bsc#1232817)
* Version 0.1.25-0
+ Don't migrate enabled systemd services, recreate them (bsc#1232575)
+ Redact JSESSIONID and pxt-session-cookie values from logs and
console output (bsc#1231568)CVSSUnscoredInsufficient evidenceSUSE-SU-2024:1508-1SUSE Linux Enterprisesuse · golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12 +10 moresuse golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12Security update for SUSE Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-node_exporter:
- Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):
* [FEATURE] Add ZFS freebsd per dataset stats #2753
* [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721
* [ENHANCEMENT] Parallelize stat calls in Linux filesystem
collector #1772
* [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711
* [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric
#2778
* [ENHANCEMENT] Improve qdisc collector performance #2779
* [ENHANCEMENT] Add include and exclude filter for hwmon
collector #2699
* [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead
of procfs #2777
* [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754
* [BUGFIX] Fallback to 32-bit stats in netdev #2757
* [BUGFIX] Close btrfs.FS handle after use #2780
* [BUGFIX] Move RO status before error return #2807
* [BUFFIX] Fix promhttp_metric_handler_errors_total being always
active #2808
* [BUGFIX] Fix nfsd v4 index miss #2824
- Update to 1.6.1:
(no source code changes in this release)
- BuildRequire go1.20
- Update to 1.6.0:
* [CHANGE] Fix cpustat when some cpus are offline #2318
* [CHANGE] Remove metrics of offline CPUs in CPU collector #2605
* [CHANGE] Deprecate ntp collector #2603
* [CHANGE] Remove bcache `cache_readaheads_totals` metrics #2583
* [CHANGE] Deprecate supervisord collector #2685
* [FEATURE] Enable uname collector on NetBSD #2559
* [FEATURE] NetBSD support for the meminfo collector #2570
* [FEATURE] NetBSD support for CPU collector #2626
* [FEATURE] Add FreeBSD collector for netisr subsystem #2668
* [FEATURE] Add softirqs collector #2669
* [ENHANCEMENT] Add suspended as a `node_zfs_zpool_state` #2449
* [ENHANCEMENT] Add administrative state of Linux network
interfaces #2515
* [ENHANCEMENT] Log current value of GOMAXPROCS #2537
* [ENHANCEMENT] Add profiler options for perf collector #2542
* [ENHANCEMENT] Allow root path as metrics path #2590
* [ENHANCEMENT] Add cpu frequency governor metrics #2569
* [ENHANCEMENT] Add new landing page #2622
* [ENHANCEMENT] Reduce privileges needed for btrfs device stats
#2634
* [ENHANCEMENT] Add ZFS `memory_available_bytes` #2687
* [ENHANCEMENT] Use `SCSI_IDENT_SERIAL` as serial in diskstats
#2612
* [ENHANCEMENT] Read missing from netlink netclass attributes
from sysfs #2669
* [BUGFIX] perf: fixes for automatically detecting the correct
tracefs mountpoints #2553
* [BUGFIX] Fix `thermal_zone` collector noise @2554
* [BUGFIX] Fix a problem fetching the user wire count on FreeBSD
2584
* [BUGFIX] interrupts: Fix fields on linux aarch64 #2631
* [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605
* [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637
* [BUGFIX] Fix bad reporting of `node_cpu_seconds_total` in
OpenBSD #2663
- Change go_modules archive in _service to use obscpio file
grafana:
- Packaging improvements:
* Changed deprecated `disabled` service mode to `manual`
* Drop golang-packaging macros
* Drop explicit mod=vendor as it is enabled automatically
- Update to version 9.5.18:
* [SECURITY] CVE-2024-1313: Require same organisation when
deleting snapshots (bsc#1222155)
- Update to version 9.5.17:
* [FEATURE] Alerting: Backport use Alertmanager API v2
- Require Go 1.20
- Update to version 9.5.16:
* [SECURITY] CVE-2023-6152: Add email verification when updating
user email (bsc#1219912)
* [BUGFIX] Annotations: Split cleanup into separate queries and
deletes to avoid deadlocks on MySQL
- Update to version 9.5.15:
* [FEATURE] Alerting: Attempt to retry retryable errors
- Update to version 9.5.14:
* [BUGFIX] Alerting: Fix state manager to not keep
datasource_uid and ref_id labels in state after Error
* [BUGFIX] Transformations: Config overrides being lost when
config from query transform is applied
* [BUGFIX] LDAP: Fix enable users on successfull login
- Update to version 9.5.13:
* [BUGFIX] BrowseDashboards: Only remember the most recent
expanded folder
* [BUGFIX] Licensing: Pass func to update env variables when
starting plugin
- Update to version 9.5.12:
* [FEATURE] Azure: Add support for Workload Identity
authentication
- Update to version 9.5.9:
* [FEATURE] SSE: Fix DSNode to not panic when response has empty
response
* [FEATURE] Prometheus: Handle the response with different field
key order
* [BUGFIX] LDAP: Fix user disabling
mgr-daemon:
- Version 4.3.9-0
* Update translation strings
spacecmd:
- Version 4.3.27-0
* Update translation strings
spacewalk-client-tools:
- Version 4.3.19-0
* Update translation strings
spacewalk-koan:
- Version 4.3.6-0
* Change Docker image location for test
uyuni-common-libs:
- Version 4.3.10-0
* Add support for package signature type V4 RSA/SHA384
* Add support for package signature type V4 RSA/SHA512 (bsc#1221465)CVSSUnscored