Security update for Multi-Linux Manager Monitoring stack
This update fixes the following issues:
prometheus-postgres_exporter:
- CVE-2022-21698: Replace github.com/prometheus/client_golang with version 1.11.1 and prevent validation bypass
and privilege escalation (bsc#1248699)
golang-github-prometheus-alertmanager:
- CVE-2026-39821: Fix validation bypass and privilege escalation by updating golang.org/x/net to version 0.55.0 (bsc#1266615)
golang-github-prometheus-prometheus was updated from version 3.5.3 to 3.5.4:
Security fixes:
- CVE-2026-39882: Fix reading unbounded HTTP response bodies by bumping OpenTelemetry to 1.43.0 (bsc#1274221)
- CVE-2026-33244: Fixed improper neutralization of
This update for Prometheus fixes the following issues:
golang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter:
- Internal changes to fix build issues with no impact for customers
golang-github-prometheus-prometheus:
- Security issues fixed:
* CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
* CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
* CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
* CVE-2025-13465: Bump lodash package to versio
Security update for golang-github-prometheus-alertmanager
This update for golang-github-prometheus-alertmanager fixes the following issues:
- Update to version 0.28.1 (jsc#PED-13285):
* Improved performance of inhibition rules when using Equal
labels.
* Improve the documentation on escaping in UTF-8 matchers.
* Update alertmanager_config_hash metric help to document the
hash is not cryptographically strong.
* Fix panic in amtool when using --verbose.
* Fix templating of channel field for Rocket.Chat.
* Fix rocketchat_configs written as rocket_configs in docs.
* Fix usage for --enable-feature flag.
* Trim whitespace from OpsGenie API Key.
* Fix Jira project template not ren
Security update for golang-github-prometheus-alertmanager
This update for golang-github-prometheus-alertmanager fixes the following issues:
- Security:
* CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238686)
* CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516)
Security update for golang-github-prometheus-alertmanager
This update for golang-github-prometheus-alertmanager fixes the following issues:
golang-github-prometheus-alertmanager was updated from version 0.23.0 to 0.26.0 (jsc#PED-7353):
- Version 0.26.0:
* Security fixes:
+ CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
* Other changes and bugs fixed:
+ Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
+ Templating: Fixed a race condition when using the title function. It is now race-safe
+ API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
+ API:
This update for Golang Prometheus fixes the following issues:
golang-github-prometheus-alertmanager:
- CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server
while validating signatures for extremely large RSA keys. (bsc#1213880)
There are no direct source changes. The CVE is fixed rebuilding the sources with the patched Go version.
golang-github-prometheus-node_exporter:
- CVE-2023-29409: Restrict RSA keys in certificates to less than or equal to 8192 bits to avoid DoSing client/server
while validating signatures for extremely large RSA keys. (bsc#1213880)
There are no d
This update for golang-github-prometheus-alertmanager and golang-github-prometheus-node_exporter fixes the following issues:
golang-github-prometheus-alertmanager:
- Security issues fixed:
* CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208051)
golang-github-prometheus-node_exporter:
- Security issues fixed in this version update to version 1.5.0 (jsc#PED-3578):
* CVE-2022-27191: Update go/x/crypto (bsc#1197284)
* CVE-2022-27664: Update go/x/net (bsc#1203185)
* CVE-2022-46146: Update exporter-toolkit (bsc#1208064)
- Other non-security bug fixes and changes in this version update to 1.5.0 (jsc#PED-3578)
Security update for golang-github-prometheus-alertmanager
This update for golang-github-prometheus-alertmanager fixes the following issues:
Update golang-github-prometheus-alertmanager from version 0.21.0 to version 0.23.0 (bsc#1196338, jsc#SLE-24077)
- CVE-2022-21698: Denial of service using InstrumentHandlerCounter
- Update vendor tarball with prometheus/client_golang 1.11.1
- Update required Go version to 1.16
- Use %autosetup macro
- Update to version 0.23.0:
* Release 0.23.0
* Release 0.23.0-rc.0
* amtool: Detect version drift and warn users (#2672)
* Add ability to skip TLS verification for amtool (#2663)
* Fix empty isEqual in amtool. (#2668)
* Fix main tests (#2670)
* cli: ad
This update fixes the following issues:
golang-github-prometheus-prometheus:
- Add support for Uyuni/SUSE Manager service discovery
+ Added 0003-Add-Uyuni-service-discovery
- Readded _service file removed in error.
- Update to 2.11.1
+ Bug Fix:
* Fix potential panic when prometheus is watching multiple zookeeper paths.
- Update to 2.11.0
+ Bug Fix:
* resolve race condition in maxGauge.
* Fix ZooKeeper connection leak.
* Improved atomicity of .tmp block replacement during compaction for usual case.
* Fix 'unknown series references' after clean shutdown.
* Re-calculate block size when calling block.Delete