SUSE-SU-2023:0811-1: grafana&distro=SUSE Manager Client Tools 12 SUSE Linux Enterprise
Published
Published 20-03-2023Last modified 04-02-2026
Vulnerability summary
SUSE-SU-2023:0811-1 is a vulnerability in grafana&distro=SUSE Manager Client Tools 12 SUSE Linux Enterprise with no CVSS score yet.
Priority
Insufficient evidence
No CVSS vector published; no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
Not scored
010
No CVSS score recordedEPSS scoreNot scoredRisk metrics not yet published.
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 4 · Downstream 0 · Related 4Timeline
- 20-03-2023PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
Security update for SUSE Manager Client Tools This update fixes the following issues: grafana: - CVE-2022-46146: Fix basic authentication bypass by updating the exporter toolkit to version 0.7.3 (bsc#1208065) - CVE-2022-41723: Require Go 1.19 or newer (bsc#1208293) - Update to version 8.5.20: * CVE-2022-23552: Security: SVG: Add dompurify preprocessor step (bsc#1207749) * CVE-2022-39324: Security: Snapshots: Fix originalUrl spoof security issue (bsc#1207750) * Security: Omit error from http response * Bug fix: Email and username trimming and invitation validation spacecmd: - Version 4.3.19-1 * Fix spacecmd not showing any output for softwarechannel_diff and softwarechannel_errata_diff (bsc#1207352) * Prevent string api parameters to be parsed as dates if not in ISO-8601 format (bsc#1205759) spacewalk-client-tools: - Version 4.3.15-1 * Update translation strings
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Version check
Known conditions: not stated in public data.
Suse3 products
- grafana&distro=SUSE Manager Client Tools 12< 8.5.20-1.42.1
- spacecmd&distro=SUSE Manager Client Tools 12< 4.3.19-38.118.1
- spacewalk-client-tools&distro=SUSE Manager Client Tools 12< 4.3.15-52.86.1
1 vendor · 3 products
References
11 linksShow all 11 references
Related vulnerabilities
Insufficient evidenceSUSE-SU-2025:4457-1SUSE Linux Enterprisesuse · golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12 +6 moresuse golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12Security update 5.0.6 for Multi-Linux Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-alertmanager:
- Update to version 0.28.1 (jsc#PED-13285):
* Improved performance of inhibition rules when using Equal
labels.
* Improve the documentation on escaping in UTF-8 matchers.
* Update alertmanager_config_hash metric help to document the
hash is not cryptographically strong.
* Fix panic in amtool when using --verbose.
* Fix templating of channel field for Rocket.Chat.
* Fix rocketchat_configs written as rocket_configs in docs.
* Fix usage for --enable-feature flag.
* Trim whitespace from OpsGenie API Key.
* Fix Jira project template not rendered when searching for
existing issues.
* Fix subtle bug in JSON/YAML encoding of inhibition rules that
would cause Equal labels to be omitted.
* Fix header for slack_configs in docs.
* Fix weight and wrap of Microsoft Teams notifications.
- Upgrade to version 0.28.0:
* CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).
* Templating errors in the SNS integration now return an error.
* Adopt log/slog, drop go-kit/log.
* Add a new Microsoft Teams integration based on Flows.
* Add a new Rocket.Chat integration.
* Add a new Jira integration.
* Add support for GOMEMLIMIT, enable it via the feature flag
--enable-feature=auto-gomemlimit.
* Add support for GOMAXPROCS, enable it via the feature flag
--enable-feature=auto-gomaxprocs.
* Add support for limits of silences including the maximum number
of active and pending silences, and the maximum size per
silence (in bytes). You can use the flags
--silences.max-silences and --silences.max-silence-size-bytes
to set them accordingly.
* Muted alerts now show whether they are suppressed or not in
both the /api/v2/alerts endpoint and the Alertmanager UI.
- Upgrade to version 0.27.0:
* API: Removal of all api/v1/ endpoints. These endpoints
now log and return a deprecation message and respond with a
status code of 410.
* UTF-8 Support: Introduction of support for any UTF-8
character as part of label names and matchers.
* Discord Integration: Enforce max length in message.
* Metrics: Introduced the experimental feature flag
--enable-feature=receiver-name-in-metrics to include the
receiver name.
* Metrics: Introduced a new gauge named
alertmanager_inhibition_rules that counts the number of
configured inhibition rules.
* Metrics: Introduced a new counter named
alertmanager_alerts_supressed_total that tracks muted alerts,
it contains a reason label to indicate the source of the mute.
* Discord Integration: Introduced support for webhook_url_file.
* Microsoft Teams Integration: Introduced support for
webhook_url_file.
* Microsoft Teams Integration: Add support for summary.
* Metrics: Notification metrics now support two new values for
the label reason, contextCanceled and contextDeadlineExceeded.
* Email Integration: Contents of auth_password_file are now
trimmed of prefixed and suffixed whitespace.
* amtool: Fixes the error scheme required for webhook url when
using amtool with --alertmanager.url.
* Mixin: Fix AlertmanagerFailedToSendAlerts,
AlertmanagerClusterFailedToSendAlerts, and
AlertmanagerClusterFailedToSendAlerts to make sure they ignore
the reason label.
grafana was updated from version 11.5.5 to 11.5.10:
- Security issues fixed:
* CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
* CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
* CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client
(bsc#1254113)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
* CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
* CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
* CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)
(bsc#1245302)
- Other changes, new features and bugs fixed:
* Version 11.5.10:
+ Update to Go 1.25
+ Update to golang.org/x/net v0.45.0
+ Auth: Fix render user OAuth passthrough
+ LDAP Authentication: Fix URL to propagate username context as parameter
* Version 11.5.9:
+ Auditing: Document new options for recording datasource query request/response body.
+ Login: Fixed redirection after login when Grafana is served from subpath.
* Version 11.5.7:
+ Azure: Fixed legend formatting and resource name determination in template variable queries.
mgr-push:
- Version 5.0.3-0
* Fixed syntax error in changelog
rhnlib:
- Version 5.0.6-0
* Use more secure defusedxml parser (bsc#1227577)
spacecmd:
- Version 5.0.14-0:
* Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586)
* Use JSON instead of pickle for spacecmd cache (bsc#1227579)
* Make spacecmd to work with Python 3.12 and higher
* Call print statements properly in Python 3
supportutils-plugin-susemanager-client:
- Version 5.0.5-0
* Fix syntax error in changelog
uyuni-tools:
- Version 0.1.37-0
* Handle CA files with symlinks during migration (bsc#1251044)
* Add a lowercase version of --logLevel (bsc#1243611)
* Adjust traefik exposed configuration for chart v27+ (bsc#1247721)
* Stop executing scripts in temporary folder (bsc#1243704)
* Convert the traefik install time to local time (bsc#1251138)
* Run smdba and reindex only during migration (bsc#1244534)
* Support config: collect podman inspect for hub container (bsc#1245099)
* Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry
* Deprecate --registry
* Use new dedicated path for Cobbler settings (bsc#1244027)
* Migrate custom auto installation snippets (bsc#1246320)
* Add SLE15SP7 to buildin productmap
* Fix loading product map from mgradm configuration file (bsc#1246068)
* Fix channel override for distro copy
* Do not use sudo when running as a root user (bsc#1246882)
* Do not require backups to be at the same location for restoring (bsc#1246906)
* Check for restorecon presence before calling (bsc#1246925)
* Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)
* Fix recomputing proxy images when installing a ptf or test (bsc#1246553)
* Add migration for server monitoring configuration (bsc#1247688)
- Version 0.1.36-0
* Bump the default image tag
- Version 0.1.35-0
* Restore SELinux contexts for restored backup volumes (bsc#1244127)
- Version 0.1.34-0
* Fix mgradm backup create handling of images and systemd files (bsc#1246738)
- Version 0.1.33-0
* Restore volumes using tar instead of podman import (bsc#1244127)CVSSUnscoredInsufficient evidenceSUSE-SU-2025:01987-1SUSE Linux Enterprisesuse · golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12 +6 moresuse golang-github-prometheus-alertmanager&distro=SUSE Manager Client Tools 12Security update for Multi-Linux Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-prometheus was updated to version 2.53.4:
- Security issues fixed:
* CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
* CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)
- Other bugs fixes from version 2.53.4:
* Runtime: fixed GOGC being set to 0 when installed
with empty prometheus.yml file resulting high cpu usage
* Scrape: fixed dropping valid metrics after previous
scrape failed
prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):
- Security issues fixed:
* CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
* CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)
- Other changes from version 0.26.0:
* Changes:
+ Replace go-kit/log with log/slog module.
* Features:
+ Add metric to record tls ciphersuite negotiated during
handshake.
+ Add a way to export labels with content matched by the probe.
Reports Certificate Serial number.
* Enhancement:
+ Add stale workflow to start sync with stale.yaml in Prometheus.
* Bug fixes:
+ Only register grpc TLS metrics on successful handshake.
- Other changes from version 0.25.0:
* Features:
+ Allow to get Probe logs by target.
+ Log errors from probe.
* Bug fixes:
+ Prevent logging confusing error message.
+ Explicit registration of internal exporter metrics.
grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):
- Security issues fixed:
* CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
* CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
* CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
* CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
* CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
* CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
* CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
* CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
* CVE-2024-9264: SQL Expressions (bsc#1231844)
* CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
* CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)
- Potential breaking changes in version 11.5.0:
* Loki: Default to /labels API with query param instead of /series API.
- Potential breaking changes in version 11.0.1:
* If you had selected your language as 'Portugu�s Brasileiro'
previously, this will be reset. You have to select it again in
your Preferences for the fix to be applied and the translations
will then be shown.
- Potential breaking changes in version 11.0.0:
* AngularJS support is turned off by default.
* Legacy alerting is entirely removed.
* Subfolders cause very rare issues with folders which have
slashes in their names.
* The input data source is removed.
* Data sources: Responses which are associated with hidden
queries will be removed (filtered) by Grafana.
* The URL which is generated when viewing an individual repeated
panel has changed.
* React Router is deprecated.
* The grafana/e2e testing tool is deprecated.
- This update brings many new features, enhancements and fixes highlighted at:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/
golang-github-prometheus-node_exporter was updated to version 1.9.1:
- Security issues fixed:
* CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)
- Other changes from version 1.9.1:
* pressure: Fix missing IRQ on older kernels
* Fix Darwin memory leak
golang-github-prometheus-alertmanager:
- Security issues fixed:
* CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238686)
* CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516)CVSSUnscoredRoutineCVE-2025-27144go-jose +692 moreGo JOSE's Parsing Vulnerable to Denial of ServiceGo JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.CVSS6.6MediumEPSS0.40%Insufficient evidenceSUSE-SU-2025:0622-1SUSE Linux Enterprisesuse · grafana&distro=SUSE Manager Client Tools 12suse grafana&distro=SUSE Manager Client Tools 12Security update for grafana
This update for grafana fixes the following issues:
grafana was updated from version 10.4.13 to 10.4.15:
- Security issues fixed:
* CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
* CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
* CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
* CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
- Other bugs fixed and changes:
* Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
* Added provisioning directories
* Use /bin/bash in wrapper scriptsCVSSUnscoredRoutineCVE-2025-1365gnu · elfutils +12 moreGNU elfutils eu-readelf readelf.c process_symtab buffer overflowA vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue.CVSS7.8HighEPSS0.34%Insufficient evidenceSUSE-SU-2025:0524-1SUSE Linux Enterprisesuse · golang-github-prometheus-prometheus&distro=SUSE Manager Client Tools 12 +6 moresuse golang-github-prometheus-prometheus&distro=SUSE Manager Client Tools 12Security update for SUSE Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):
- Security issues fixed:
* CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error
handling (bsc#1232970)
- Highlights of other changes:
* Performance:
+ Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and
remote write operations.
+ Default GOGC value lowered to 75 for better memory management.
+ Option to limit memory usage from dropped targets added.
* New Features:
+ Experimental OpenTelemetry ingestion.
+ Automatic memory limit handling.
+ Native histogram support, including new functions, UI enhancements, and improved scraping.
+ Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.
+ Expanded service discovery options with added metadata and support for new services.
+ New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.
* Bug Fixes:
+ Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.
* For a detailed list of changes consult the package changelog or
https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3
golang-github-prometheus-promu was updated to version 0.17.0:
- Added codesign utility function
grafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):
- Security issues fixed:
* CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading
golang.org/x/crypto (bsc#1234554)
* CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)
* CVE-2023-6152: Add email verification when updating user email (bsc#1219912)
* CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)
* CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)
- Potential breaking changes in version 10:
* In panels using the `extract fields` transformation, where one
of the extracted names collides with one of the already
existing ields, the extracted field will be renamed.
* For the existing backend mode users who have table
visualization might see some inconsistencies on their panels.
We have updated the table column naming. This will
potentially affect field transformations and/or field
overrides. To resolve this either: update transformation or
field override.
* For the existing backend mode users who have Transformations
with the `time` field, might see their transformations are
not working. Those panels that have broken transformations
will fail to render. This is because we changed the field
key. To resolve this either: Remove the affected panel and
re-create it; Select the `Time` field again; Edit the `time`
field as `Time` for transformation in `panel.json` or
`dashboard.json`
* The following data source permission endpoints have been removed:
`GET /datasources/:datasourceId/permissions`
`POST /api/datasources/:datasourceId/permissions`
`DELETE /datasources/:datasourceId/permissions`
`POST /datasources/:datasourceId/enable-permissions`
`POST /datasources/:datasourceId/disable-permissions`
+ Please use the following endpoints instead:
`GET /api/access-control/datasources/:uid` for listing data
source permissions
`POST /api/access-control/datasources/:uid/users/:id`,
`POST /api/access-control/datasources/:uid/teams/:id` and
`POST /api/access-control/datasources/:uid/buildInRoles/:id`
for adding or removing data source permissions
* If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your
provider.
* For the existing backend mode users who have table visualization might see some inconsistencies on their panels.
We have updated the table column naming. This will potentially affect field transformations and/or field overrides.
* The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed.
Dashboard information can be retrieved from the `/dashboard/...` APIs.
* The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`
* Removed all components for the old panel header design.
* Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/
for more details
* OAuth role mapping enforcement: This change impacts GitHub,
Gitlab, Okta, and Generic OAuth. To avoid overriding manually
set roles, enable the skip_org_role_sync option in the
Grafana configuration for your OAuth provider before
upgrading
* Angular has been deprecated
* Grafana legacy alerting has been deprecated
* API keys are migrating to service accounts
* The experimental “dashboard previews” feature is removed
* Usernames are now case-insensitive by default
* Grafana OAuth integrations do not work anymore with email lookups
* The “Alias” field in the CloudWatch data source is removed
* Athena data source plugin must be updated to version >=2.9.3
* Redshift data source plugin must be updated to version >=1.8.3
* DoiT International BigQuery plugin no longer supported
* Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0
for more details
- This update brings many new features, enhancements and fixes highlighted at:
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/
* https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/
spacecmd was updated to version 5.0.11-0:
- Updated translation strings
supportutils-plugin-salt was updated to version 1.2.3:
- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)
- Provide backwards-compatible scripts version
supportutils-plugin-susemanager-client was updated to version 5.0.4-0:
- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)
uyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:
- Security issues fixed:
* CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)
- Other changes and bugs fixed:
* Version 0.1.27-0
+ Bump the default image tag to 5.0.3
+ IsInstalled function fix
+ Run systemctl daemon-reload after changing the container image config (bsc#1233279)
+ Coco-replicas-upgrade
+ Persist search server indexes (bsc#1231759)
+ Sync deletes files during migration (bsc#1233660)
+ Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)
+ Add --registry back to mgrpxy (bsc#1233202)
+ Only add java.hostname on migrated server if not present
+ Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)
+ Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)
+ Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)
* Version 0.1.26-0
+ Ignore all zypper caches during migration (bsc#1232769)
+ Use the uyuni network for all podman containers (bsc#1232817)
* Version 0.1.25-0
+ Don't migrate enabled systemd services, recreate them (bsc#1232575)
+ Redact JSESSIONID and pxt-session-cookie values from logs and
console output (bsc#1231568)CVSSUnscored