Security update for Multi-Linux Manager Monitoring stack
This update fixes the following issues:
prometheus-postgres_exporter:
- CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass
and privilege escalation (bsc#1248699)
golang-github-prometheus-alertmanager:
- CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)
golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:
Security fixes:
- CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
- CVE-2026-33244: Fixed improper neutralization of
Security update 5.0.7 for Multi-Linux Manager Client Tools
This update fixes the following issues:
dracut-saltboot:
- Version update to 1.1.0:
* Retry DHCP requests up to 3 times (bsc#1253004)
golang-github-QubitProducts-exporter_exporter:
- Non-customer-facing optimization and update
golang-github-boynux-squid_exporter:
- Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):
* Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path
* Added TLS and Basic Authentication to the exporter’s web interface
* Added support for the exporter to authenticate against the Squid proxy itself
* Allow the gathering of proc
Security update 5.0.6 for Multi-Linux Manager Client Tools
This update fixes the following issues:
dracut-saltboot:
- Update to version 1.0.0
* Reboot on salt key timeout (bsc#1237495)
* Fixed parsing files with space in the name (bsc#1252100)
grafana was updated from version 11.5.5 to 11.5.10:
- Security issues fixed:
* CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
* CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
* CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client
(bsc#1254113)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
* CVE-2025-6023: Fixed cross-si
Security update for Multi-Linux Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-prometheus was updated to version 2.53.4:
- Security issues fixed:
* CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
* CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)
- Other bugs fixes from version 2.53.4:
* Runtime: fixed GOGC being set to 0 when installed
with empty prometheus.yml file resulting high cpu usage
* Scrape: fixed dropping valid metrics after previous
scrape failed
prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):
- Security issues fixed:
* CVE-2025-228
This update for grafana fixes the following issues:
grafana was updated from version 10.4.13 to 10.4.15:
- Security issues fixed:
* CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
* CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
* CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
* CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
- Other bugs fixed and changes:
* Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
* Added provisioning directories
* Use /bin/ba
This update fixes the following issues:
dracut-saltboot was updated to version 0.1.1728559936.c16d4fb:
- Added MAC based terminal naming option (jsc#SUMA-314)
golang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):
- Security issues fixed:
* CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error
handling (bsc#1232970)
- Highlights of other changes:
* Performance:
+ Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and
remote write operations.
+ Default GOGC value lowered to 75 for better memory management.
This update fixes the following issues:
POS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:
- Version 0.1.1710765237.46af599
* Moved image services to dracut-saltboot package
* Use salt bundle
- Version 0.1.1645440615.7f1328c
* Removed deprecated kiwi functions
POS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:
- Version 0.1.1710765237.46af599
* Moved image services to dracut-saltboot package
* Use salt bundle
- Version 0.1.1645440615.7f1328c
* Removed deprecated kiwi functions
ansible received the following fixes:
- Security issues fixed:
* CVE-2023-5764: Address issues where internal te
This update fixes the following issues:
golang-github-lusitaniae-apache_exporter:
- Do not strip if SUSE Linux Enterprise 15 SP3
- Exclude debug for Red Hat Enterprise Linux >= 8
- Build with Go >= 1.20 when the OS is not Red Hat Enterprise Linux
mgr-daemon:
- Version 4.3.8-1
* Update translation strings
prometheus-postgres_exporter:
- Remove duplicated call to systemd requirements
- Do not build debug if Red Hat Enterprise Linux >= 8
- Do not strip if SUSE Linux Enterprise 15 SP3
- Build at least with with Go >= 1.18 on Red Hat Enterprise Linux
- Build with Go >= 1.20 elsewhere
spacecmd:
- Version 4.3.26-1
* Update translation s
This update fixes the following issues:
golang-github-lusitaniae-apache_exporter:
- Security issues fixed:
* CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
* CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
* CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
- Changes and bugs fixed:
* Updated to 1.0.0 (jsc#PED-5405)
+ Improved flag parsing
+ Added support for custom headers
* Changes from 0.13.1
+ Fix panic caused by missing flagConfig options
* Added AppArmor profile
* Added sandboxing options to systemd service unit
* Build using promu
* Build with Go
This update fixes the following issues:
grafana:
- Update to version 9.5.5:
* CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694)
* Bug fixes:
* Auth: Show invite button if disable login form is set to false.
* Azure: Fix Kusto auto-completion for Azure datasources.
* RBAC: Remove legacy AC editor and admin role on new dashboard route.
* API: Revert allowing editors to access GET /datasources.
* Settings: Add ability to override skip_org_role_sync with Env variables.
- Update to version 9.5.3:
* CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#
This update fixes the following issues:
bind:
- Provide bind dependencies and solve installation issues on SUSE Linux Enterprise Micro
- There are no source changes
dracut-saltboot:
- Update to version 0.1.1681904360.84ef141
* Load network configuration even when missing protocol version (bsc#1210640)
grafana:
- Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
* Security fixes:
- CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
- CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests
(bnc#1210907)
- C
This update fixes the following issues:
grafana version update from 8.5.20 to 8.5.22:
- Security issues fixed:
* CVE-2023-1410: Fix XSS in Graphite functions tooltip (bsc#1209645)
* CVE-2023-0507: Apply attribute sanitation to GeomapPanel (bsc#1208821)
* CVE-2023-0594: Avoid storing XSS in TraceView panel (bsc#1208819)
- The following non-security bug was fixed:
* Login: Fix panic when UpsertUser is called without ReqContext
This update fixes the following issues:
dracut-saltboot:
- Update to verion 0.1.1674034019.a93ff61
* Install copied wicked config as client.xml (bsc#1205599)
- Update to version 0.1.1673279145.e7616bd
grafana:
- CVE-2022-46146: Fix basic authentication bypass by updating the exporter
toolkit to version 0.7.3 (bsc#1208065,)
- CVE-2022-41723: Require Go 1.19 or newer (bsc#1208293)
- Update to version 8.5.20:
* CVE-2022-23552: Security: SVG: Add dompurify preprocessor step (bsc#1207749)
* CVE-2022-39324: Security: Snapshots: Fix originalUrl spoof security issue
(bsc#1207750)
* Security: Omit error from http response
* Bug f
This update fixes the following issues:
dracut-saltboot:
- Update to version 0.1.1673279145.e7616bd
* Add failsafe stop file when salt-minion does not stop (bsc#1172110)
* Copy existing wicked config instead of generating new (bsc#1205599)
grafana:
- Update to version 8.5.15 (jsc#PED-2617):
* CVE-2022-39306: Fix for privilege escalation (bsc#1205225)
* CVE-2022-39307: Omit error from http response when user does not exists (bsc#1205227)
- Update to version 8.5.14:
* CVE-2022-39201: Fix do not forward login cookie in outgoing requests (bsc#1204303)
* CVE-2022-31130: Make proxy endpoints not leak sensitive HTTP headers (bsc#
This update fixes the following issues:
dracut-saltboot:
- Update to version 0.1.1665997480.587fa10
* Add dependencies on xz and gzip to support compressed images
golang-github-boynux-squid_exporter:
- Exclude s390 architecture
- Enhanced to build on Enterprise Linux 8.
grafana:
- Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
- Security fixes:
* CVE-2022-36062: (bsc#1203596)
* CVE-2022-35957: (bsc#1203597)
* CVE-2022-31107: (bsc#1201539)
* CVE-2022-31097: (bsc#1201535)
* CVE-2022-29170: (bsc#1199810)
* CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
* CVE-2021-43798: (bsc#1193492)
* CVE-2021-41244: (bsc#1192763)
This update fixes the following issues:
dracut-saltboot:
- Update to version 0.1.1661440542.6cbe0da
* Use standard susemanager.conf
* Move image services to dracut-saltboot package
* Use salt bundle
golang-github-lusitaniae-apache_exporter:
- Update to upstream release 0.11.0 (jsc#SLE-24791)
* Add TLS support
* Switch to logger, please check --log.level and --log.format
flags
- Update to version 0.10.1
* Bugfix: Reset ProxyBalancer metrics on each scrape to
remove stale data
- Update to version 0.10.0
* Add Apache Proxy and other metrics
- Update to version 0.8.0
* Change commandline flags
* Add metrics: Apache
This update fixes the following issues:
grafana:
- Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422)
+ Security:
* Fixes XSS vulnerability in handling data sources
(bsc#1195726, CVE-2022-21702)
* Fixes cross-origin request forgery vulnerability
(bsc#1195727, CVE-2022-21703)
* Fixes Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728, CVE-2022-21713)
- Update to Go 1.17.
- Add build-time dependency on `wire`.
- Update license to GNU Affero General Public License v3.0.
- Update to version 8.3.4
* GetUserInfo: return an error if no user was found
(bsc#1194873, C
This update for grafana fixes the following issues:
- CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)
- Update to version 7.5.7:
* Updated relref to 'Configuring exemplars' section (#34240) (#34243)
* Added exemplar topic (#34147) (#34226)
* Quota: Do not count folders towards dashboard quota (#32519) (#34025)
* Instructions to separate emails with semicolons (#32499) (#34138)
* Docs: Remove documentation of v8 generic OAuth feature (#34018)
* Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
* [GH-33898] A