Security update 5.0.7 for Multi-Linux Manager Client Tools
This update fixes the following issues:
dracut-saltboot:
- Version update to 1.1.0:
* Retry DHCP requests up to 3 times (bsc#1253004)
golang-github-QubitProducts-exporter_exporter:
- Non-customer-facing optimization and update
golang-github-boynux-squid_exporter:
- Version update from 1.6.0 to 1.13.0 with the following highlighted changes and fixes (jsc#PED-14971):
* Added compatibility for Squid 6 and support for the squid-internal-mgr metrics path
* Added TLS and Basic Authentication to the exporter’s web interface
* Added support for the exporter to authenticate against the Squid proxy itself
* Allow the gathering of proc
Security update for Multi-Linux Manager Client Tools
This update fixes the following issues:
golang-github-prometheus-prometheus was updated to version 2.53.4:
- Security issues fixed:
* CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
* CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)
- Other bugs fixes from version 2.53.4:
* Runtime: fixed GOGC being set to 0 when installed
with empty prometheus.yml file resulting high cpu usage
* Scrape: fixed dropping valid metrics after previous
scrape failed
prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):
- Security issues fixed:
* CVE-2025-228
This update fixes the following issues:
golang-github-lusitaniae-apache_exporter:
- Security issues fixed:
* CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
* CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
* CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
- Changes and bugs fixed:
* Updated to 1.0.0 (jsc#PED-5405)
+ Improved flag parsing
+ Added support for custom headers
* Changes from 0.13.1
+ Fix panic caused by missing flagConfig options
* Added AppArmor profile
* Added sandboxing options to systemd service unit
* Build using promu
* Build with Go
This update fixes the following issues:
python-tornado:
- Security fixes:
* CVE-2023-28370: Fixed an open redirect issue in the static file handler (bsc#1211741)
prometheus-blackbox_exporter:
- Use obscpio for go modules service
- Set version number
- Set build date from SOURCE_DATE_EPOCH
- Update to 0.24.0 (bsc#1212279, jsc#PED-4556)
* Requires go1.19
- Avoid empty validation script
- Add rc symlink for backwards compatibility
spacecmd:
- Version 4.3.22-1
* Bypass traditional systems check on older SUMA instances (bsc#1208612)
This update fixes the following issues:
prometheus-blackbox_exporter:
- Security issues fixed:
* CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208062)
- Other non-security bugs fixed and changes:
* Add `min_version` parameter of `tls_config` to allow enabling TLS 1.0 and 1.1 (bsc#1209113)
* On SUSE Linux Enterprise build always with Go >= 1.19 (bsc#1203599)
prometheus-postgres_exporter:
- Security issues fixed:
* CVE-2022-46146: Fix authentication bypass via cache poisoning (bsc#1208060)
- Other non-security bugs fixed and changes:
* Adapt the systemd service security configuration to be able to start i
This update fixes the following issues:
dracut-saltboot:
- Update to version 0.1.1665997480.587fa10
* Add dependencies on xz and gzip to support compressed images
golang-github-boynux-squid_exporter:
- Exclude s390 architecture
- Enhanced to build on Enterprise Linux 8.
grafana:
- Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
- Security fixes:
* CVE-2022-36062: (bsc#1203596)
* CVE-2022-35957: (bsc#1203597)
* CVE-2022-31107: (bsc#1201539)
* CVE-2022-31097: (bsc#1201535)
* CVE-2022-29170: (bsc#1199810)
* CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
* CVE-2021-43798: (bsc#1193492)
* CVE-2021-41244: (bsc#1192763)
Important security update for SUSE Manager Client Tools
This update fixes the following issues:
ansible:
- Update to version 2.9.27 (jsc#SLE-23631, jsc#SLE-24133)
* CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27) (bsc#1187725)
* CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23) (bsc#1188061)
* ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15) (bsc#1176460)
- Update to 2.9.22:
* CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
* CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
* CVE-2021-20191 (bsc#1181119) multiple coll