Your message dated Fri, 23 Dec 2022 12:47:09 +0000
with message-id <[email protected]>
and subject line Bug#1025127: fixed in
golang-github-prometheus-exporter-toolkit 0.5.1-2+deb11u2
has caused the Debian Bug report #1025127,
regarding golang-github-prometheus-exporter-toolkit: CVE-2022-46146
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1025127: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1025127
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: golang-github-prometheus-exporter-toolkit
Version: 0.8.1-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for
golang-github-prometheus-exporter-toolkit.
CVE-2022-46146[0]:
| Prometheus Exporter Toolkit is a utility package to build exporters.
| Prior to versions 0.7.2 and 0.8.2, i someone has access to a
| Prometheus web.yml file and users' bcrypted passwords, they can bypass
| security by poisoning the built-in authentication cache. Versions
| 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround,
| but attacker must have access to the hashed password to use this
| functionality.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-46146
https://www.cve.org/CVERecord?id=CVE-2022-46146
[1]
https://github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: golang-github-prometheus-exporter-toolkit
Source-Version: 0.5.1-2+deb11u2
Done: Martina Ferrari <[email protected]>
We believe that the bug you reported is fixed in the latest version of
golang-github-prometheus-exporter-toolkit, which is due to be installed in the
Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Martina Ferrari <[email protected]> (supplier of updated
golang-github-prometheus-exporter-toolkit package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 19 Dec 2022 23:02:39 +0000
Source: golang-github-prometheus-exporter-toolkit
Architecture: source
Version: 0.5.1-2+deb11u2
Distribution: bullseye
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Martina Ferrari <[email protected]>
Closes: 1025127
Changes:
golang-github-prometheus-exporter-toolkit (0.5.1-2+deb11u2) bullseye;
urgency=medium
.
* Backport fix for CVE-2022-46146. Closes: #1025127.
Checksums-Sha1:
98470c782739a21c04564ecd0ed97b599a1048bf 2665
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2.dsc
b2411d047da0a6ed3f68b591057b9dae3ca3f9f8 3776
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2.debian.tar.xz
7e90e73fa7780f8939ce98fde32ced52389c5bc0 8950
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2_amd64.buildinfo
Checksums-Sha256:
fc9c60f3616ff9937c2a6c0aeac215d596586d4219083e090f32f435b7a3d03c 2665
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2.dsc
774050952ce48f2453ba125c05ac48831e9ab880b5230f5cd256e1f097a17588 3776
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2.debian.tar.xz
5bec6623f2503c35770ada10019e3d5fd9542d6bded29ad8fe5ce166abc46e25 8950
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2_amd64.buildinfo
Files:
29ab883f6d09c24dcd5f27ebb39c4e40 2665 devel optional
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2.dsc
3fa32ed8abfe3230b0a4d54f9078ad8a 3776 devel optional
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2.debian.tar.xz
361655930a4a1817aa56e99a39052f15 8950 devel optional
golang-github-prometheus-exporter-toolkit_0.5.1-2+deb11u2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEE2qbv8cYn6hwmsaaSqiMPxF+MJ7EFAmOg73cACgkQqiMPxF+M
J7GviA/8DuhUi+dhaLTF6U028whCTg7cvZV3/9oXVh34DdL9KfwNpNdvQ1HZ3AN1
eTX6U4FSR6Sv7+y51UoRhzMVZzjbGYQWi9TcpgG3NiaUOoDux3MgJfFBdtW2i4tC
aaTDJ2gLx2Eg1v4+TeGttQ0QdEzAdQjJofgw9ppWxLkpCDDSsMB/58fY6EJ9tK7B
GAnGf2cAvKGvQU8B6iUM9RVf0WsIiZdeDkF2GOSZvH5AhkyegF+MH6qCH7ZsU0Pn
+NDQL3EFsc2pQeZzapNCtr+/9XuEpIRQvcatoAOvNkIYh8XrmyRq7XMO/KmfaK3T
LkCThGUY+bMQEg83sOP1ai8xobPy3Jegc85PLwL2xUz/Yxy9XzKk7/K7Gas/Y+I1
qD+NG2V/N/oPJke7yApWRLPORpDQMrAykcWadKg2YJt1GKQkDyYL6NQ03ya8LhQ5
rFCEhAxpq0JjjSHiFOK9ZmQuwwQrG+RwTkoQ1QHdtZTiUMQSKuD+sfLunNckITOA
Lzb9ou25Ubwp4A8FWjtVJtQz155c66R1dpSBC37uUY4zXbcfOa4s0hfIu8+3h+ga
ukbPVCCsA/Riz7L1k9dLmFZNUa5l5VRaFD45EtkHHTfm2NXUZnGt1AP1fglEB9NA
lySDkL1U+b50Z6g99xvI1ECXW9mQHA8UdDVq/vw8v2D5dvaIb5Y=
=8m1k
-----END PGP SIGNATURE-----
--- End Message ---
