<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for golang-github-prometheus-node_exporter</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:2137-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-06-20T12:47:07Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-06-20T12:47:07Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-06-20T12:47:07Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for golang-github-prometheus-node_exporter</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for golang-github-prometheus-node_exporter fixes the following issues:

- CVE-2022-21698: Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)

- Update to 1.3.0
  * [CHANGE] Add path label to rapl collector #2146
  * [CHANGE] Exclude filesystems under /run/credentials #2157
  * [CHANGE] Add TCPTimeouts to netstat default filter #2189
  * [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  * [FEATURE] Add darwin powersupply collector #1777
  * [FEATURE] Add support for monitoring GPUs on Linux #1998
  * [FEATURE] Add Darwin thermal collector #2032
  * [FEATURE] Add os release collector #2094
  * [FEATURE] Add netdev.address-info collector #2105
  * [FEATURE] Add clocksource metrics to time collector #2197
  * [ENHANCEMENT] Support glob textfile collector directories #1985
  * [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  * [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  * [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  * [ENHANCEMENT] Add DMI collector #2131
  * [ENHANCEMENT] Add threads metrics to processes collector #2164
  * [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  * [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  * [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  * [BUGFIX] ethtool: Sanitize metric names #2093
  * [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  * [BUGFIX] Fix possible panic on macOS #2133
  * [BUGFIX] Collect flag_info and bug_info only for one core #2156
  * [BUGFIX] Prevent duplicate ethtool metric names #2187

- Update to 1.2.2
  * Bug fixes
     Fix processes collector long int parsing #2112

- Update to 1.2.1
  * Removed
     Remove obsolete capture permission denied error patch that was already included upstream.
  * Bug fixes
     Fix zoneinfo parsing prometheus/procfs#386
     Fix nvme collector log noise #2091
     Fix rapl collector log noise #2092

- Update to 1.2.0
  * Changes
     Rename filesystem collector flags to match other collectors #2012
     Make node_exporter print usage to STDOUT #203
  * Features
     Add conntrack statistics metrics #1155
     Add ethtool stats collector #1832
     Add flag to ignore network speed if it is unknown #1989
     Add tapestats collector for Linux #2044
     Add nvme collector #2062
  * Enhancements
     Add ErrorLog plumbing to promhttp #1887
     Add more Infiniband counters #2019
     netclass: retrieve interface names and filter before parsing #2033
     Add time zone offset metric #2060
  * Bug fixes
     Handle errors from disabled PSI subsystem #1983
     Fix panic when using backwards compatible flags #2000
     Fix wrong value for OpenBSD memory buffer cache #2015
     Only initiate collectors once #2048
     Handle small backwards jumps in CPU idle #2067

- Capture permission denied error for 'energy_uj' file (bsc#1190535)

- Update to 1.1.2
  * Bug fixes
    + Handle errors from disabled PSI subsystem #1983
    + Sanitize strings from /sys/class/power_supply #1984
    + Silence missing netclass errors #1986

- Trim old specfile constructs

- Migrate to obs_scm
- Migrate to go_modules
- Update to 1.1.1
  * Bug fixes
    + Fix ineffassign issue #1957
    + Fix some noisy log lines #1962
- Update to 1.1.0
  * Changes
    + Improve filter flag names #1743
    + Add btrfs and powersupplyclass to list of exporters enabled by default #1897
  * Features
    + Add fibre channel collector #1786
    + Expose cpu bugs and flags as info metrics. #1788
    + Add network_route collector #1811
    + Add zoneinfo collector #1922
  * Enhancements
    + Add more InfiniBand counters #1694
    + Add flag to aggr ipvs metrics to avoid high cardinality metrics #1709    
    + Adding backlog/current queue length to qdisc collector #1732    
    + Include TCP OutRsts in netstat metrics #1733    
    + Add pool size to entropy collector #1753    
    + Remove CGO dependencies for OpenBSD amd64 #1774    
    + bcache: add writeback_rate_debug stats #1658    
    + Add check state for mdadm arrays via node_md_state metric #1810    
    + Expose XFS inode statistics #1870    
    + Expose zfs zpool state #1878    
    + Added an ability to pass collector.supervisord.url via SUPERVISORD_URL environment variable #1947
  * Bug fixes
    + filesystem_freebsd: Fix label values #1728
    + Fix various procfs parsing errors #1735
    + Handle no data from powersupplyclass #1747
    + udp_queues_linux.go: change upd to udp in two error strings #1769
    + Fix node_scrape_collector_success behaviour #1816
    + Fix NodeRAIDDegraded to not use a string rule expressions #1827
    + Fix node_md_disks state label from fail to failed #1862
    + Handle EPERM for syscall in timex collector #1938
    + bcache: fix typo in a metric name #1943
    + Fix XFS read/write stats (https://github.com/prometheus/procfs/pull/343)

- Do not include sources (bsc#1151558)
- Remove rc symlink
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-2137,SUSE-SLE-Product-HPC-15-2022-2137,SUSE-SLE-Product-SLES-15-2022-2137,SUSE-SLE-Product-SLES_SAP-15-2022-2137</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222137-1/</URL>
      <Description>Link for SUSE-SU-2022:2137-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-June/011313.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:2137-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1151558</URL>
      <Description>SUSE Bug 1151558</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1190535</URL>
      <Description>SUSE Bug 1190535</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1196338</URL>
      <Description>SUSE Bug 1196338</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-21698/</URL>
      <Description>SUSE CVE CVE-2022-21698 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15-ESPOS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15-ESPOS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15-ESPOS" CPE="cpe:/o:suse:sle_hpc-espos:15">SUSE Linux Enterprise High Performance Computing 15-ESPOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15-LTSS" CPE="cpe:/o:suse:sle_hpc-ltss:15">SUSE Linux Enterprise High Performance Computing 15-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 15-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 15-LTSS" CPE="cpe:/o:suse:sles-ltss:15">SUSE Linux Enterprise Server 15-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 15">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15" CPE="cpe:/o:suse:sles_sap:15">SUSE Linux Enterprise Server for SAP Applications 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1">
      <FullProductName ProductID="golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1">golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1</FullProductName>
    </Branch>
    <Relationship ProductReference="golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15-ESPOS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15-ESPOS:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1">golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15-LTSS:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1">golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15-LTSS:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1">golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1 as a component of SUSE Linux Enterprise Server 15-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1">golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.</Note>
    </Notes>
    <CVE>CVE-2022-21698</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise High Performance Computing 15-ESPOS:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15-LTSS:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15-LTSS:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15:golang-github-prometheus-node_exporter-1.3.0-150000.3.12.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20222137-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-21698.html</URL>
        <Description>CVE-2022-21698</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1196338</URL>
        <Description>SUSE Bug 1196338</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
