Oval Definition:	oval:org.opensuse.security:def:202221698
Revision Date: 2023-06-22 Version: 1 Title: CVE-2022-21698 Description: client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. Family: unix Class: vulnerability Status: Reference(s): Mitre CVE-2022-21698 SUSE CVE-2022-21698 SUSE-SU-2022:1433-1 SUSE-SU-2022:1434-1 SUSE-SU-2022:1435-1 SUSE-SU-2022:1531-1 SUSE-SU-2022:1545-1 SUSE-SU-2022:2134-1 SUSE-SU-2022:2137-1 SUSE-SU-2022:2139-1 SUSE-SU-2022:2140-1 SUSE-SU-2022:2145-1 SUSE-SU-2022:2834-1 SUSE-SU-2022:2839-1 SUSE-SU-2022:2839-2 SUSE-CU-2022:2092-1 SUSE-CU-2022:2093-1 SUSE-CU-2022:2094-1 SUSE-CU-2023:508-1 SUSE-SU-2022:3745-1 SUSE-SU-2022:3747-1 Platform(s): Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed SUSE CaaS Platform 4.0 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Desktop 15 SP3 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Desktop Applications 15 SP3 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.1 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 SUSE Linux Enterprise Real Time 15 SP2 SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP2-BCL SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Storage 7.1 SUSE Manager Proxy 4.1 SUSE Manager Proxy 4.2 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.1 SUSE Manager Retail Branch Server 4.2 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.1 SUSE Manager Server 4.2 SUSE Manager Server 4.3 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 Product(s): Definition Synopsis Release Information SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 is installed OR SUSE Manager Proxy 4.2 is installed AND golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 is installed OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-macros-0.9.3-150300.3.6.1 is installed OR firewalld-0.9.3-150300.3.6.1 is installed OR firewalld-lang-0.9.3-150300.3.6.1 is installed OR python3-firewall-0.9.3-150300.3.6.1 is installed OR golang-github-prometheus-node_exporter is affected OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Desktop Applications 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-applet-0.9.3-150300.3.6.1 is installed OR firewall-config-0.9.3-150300.3.6.1 is installed OR Package Information Image SLES15-SP3-Manager-4-2-Proxy-BYOS-Azure is installed OR Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure is installed AND firewalld-0.9.3-150300.3.6.1 is installed OR python3-firewall-0.9.3-150300.3.6.1 is installed Definition Synopsis Release Information SUSE Linux Enterprise Module for SUSE Manager Proxy 4.2 is installed OR SUSE Manager Proxy 4.2 is installed AND golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 is installed OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-macros-0.9.3-150300.3.6.1 is installed OR firewalld-0.9.3-150300.3.6.1 is installed OR firewalld-lang-0.9.3-150300.3.6.1 is installed OR python3-firewall-0.9.3-150300.3.6.1 is installed OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Desktop Applications 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-applet-0.9.3-150300.3.6.1 is installed OR firewall-config-0.9.3-150300.3.6.1 is installed Definition Synopsis Release Information SUSE Linux Enterprise Desktop 15 SP4 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP4 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP4 is installed OR SUSE Linux Enterprise Server 15 SP4 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP4 is installed OR SUSE Manager Proxy 4.3 is installed OR SUSE Manager Retail Branch Server 4.3 is installed OR SUSE Manager Server 4.3 is installed AND golang-github-prometheus-node_exporter is affected OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-macros-0.9.3-150300.3.6.1 is installed OR firewalld-0.9.3-150300.3.6.1 is installed OR firewalld-lang-0.9.3-150300.3.6.1 is installed OR python3-firewall-0.9.3-150300.3.6.1 is installed OR golang-github-prometheus-node_exporter is affected OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Desktop Applications 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-applet-0.9.3-150300.3.6.1 is installed OR firewall-config-0.9.3-150300.3.6.1 is installed Definition Synopsis Release Information SUSE CaaS Platform 4.0 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP1 is installed AND golang-github-prometheus-node_exporter is affected Definition Synopsis SUSE Linux Enterprise Server for SAP Applications 15 SP1 is installed AND golang-github-prometheus-node_exporter is affected Definition Synopsis Release Information SUSE OpenStack Cloud 8 is installed OR SUSE OpenStack Cloud Crowbar 8 is installed AND golang-github-prometheus-node_exporter is affected Definition Synopsis Release Information SUSE OpenStack Cloud 9 is installed OR SUSE OpenStack Cloud Crowbar 9 is installed AND golang-github-prometheus-node_exporter is affected Definition Synopsis Release Information SUSE Linux Enterprise Real Time 15 SP2 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP2 is installed OR SUSE Manager Proxy 4.1 is installed OR SUSE Manager Retail Branch Server 4.1 is installed OR SUSE Manager Server 4.1 is installed AND golang-github-prometheus-node_exporter is affected OR Package Information SUSE Linux Enterprise Module for SUSE Manager Proxy 4.1 is installed OR SUSE Manager Proxy 4.1 is installed AND firewalld-prometheus-config-0.1-150100.4.9.2 is installed OR golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 is installed Definition Synopsis openSUSE Tumbleweed is installed AND kubeseal-0.17.4-1.1 is installed Definition Synopsis SUSE Linux Enterprise Micro 5.1 is installed AND Package Information firewalld-0.9.3-150300.3.6.1 is installed OR python3-firewall-0.9.3-150300.3.6.1 is installed Definition Synopsis SUSE Linux Enterprise Micro 5.2 is installed AND Package Information firewalld-0.9.3-150300.3.6.1 is installed OR python3-firewall-0.9.3-150300.3.6.1 is installed Definition Synopsis Release Information SUSE Linux Enterprise Real Time 15 SP2 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP2 is installed AND golang-github-prometheus-node_exporter is affected OR Package Information SUSE Enterprise Storage 7.1 is installed AND rook is affected OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-macros-0.9.3-150300.3.6.1 is installed OR firewalld-0.9.3-150300.3.6.1 is installed OR firewalld-lang-0.9.3-150300.3.6.1 is installed OR python3-firewall-0.9.3-150300.3.6.1 is installed OR golang-github-prometheus-node_exporter is affected OR Package Information SUSE Linux Enterprise Desktop 15 SP3 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP3 is installed OR SUSE Linux Enterprise Module for Desktop Applications 15 SP3 is installed OR SUSE Linux Enterprise Server 15 SP3 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP3 is installed OR SUSE Linux Enterprise Storage 7.1 is installed OR SUSE Manager Proxy 4.2 is installed OR SUSE Manager Retail Branch Server 4.2 is installed OR SUSE Manager Server 4.2 is installed AND firewall-applet-0.9.3-150300.3.6.1 is installed OR firewall-config-0.9.3-150300.3.6.1 is installed OR Package Information SUSE Enterprise Storage 7 is installed AND golang-github-prometheus-node_exporter is affected OR rook-ceph-helm-charts is affected OR rook-k8s-yaml is affected Definition Synopsis openSUSE Leap 15.3 is installed AND Package Information firewall-applet-0.9.3-150300.3.6.1 is installed AND firewall-applet is signed with openSUSE key OR firewall-config-0.9.3-150300.3.6.1 is installed AND firewall-config is signed with openSUSE key OR firewall-macros-0.9.3-150300.3.6.1 is installed AND firewall-macros is signed with openSUSE key OR firewalld-0.9.3-150300.3.6.1 is installed AND firewalld is signed with openSUSE key OR firewalld-lang-0.9.3-150300.3.6.1 is installed AND firewalld-lang is signed with openSUSE key OR golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 is installed AND golang-github-prometheus-prometheus is signed with openSUSE key OR python3-firewall-0.9.3-150300.3.6.1 is installed AND python3-firewall is signed with openSUSE key Definition Synopsis openSUSE Leap 15.4 is installed AND Package Information golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 is installed AND golang-github-prometheus-alertmanager is signed with openSUSE key OR golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 is installed AND golang-github-prometheus-node_exporter is signed with openSUSE key OR golang-github-prometheus-prometheus-2.32.1-150100.4.9.2 is installed AND golang-github-prometheus-prometheus is signed with openSUSE key Definition Synopsis Release Information SUSE Linux Enterprise Desktop 15 SP4 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP4 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP4 is installed OR SUSE Linux Enterprise Server 15 SP4 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP4 is installed OR SUSE Manager Proxy 4.3 is installed OR SUSE Manager Retail Branch Server 4.3 is installed OR SUSE Manager Server 4.3 is installed AND golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 is installed Definition Synopsis Release Information SUSE Linux Enterprise Desktop 15 SP4 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP4 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP4 is installed OR SUSE Linux Enterprise Server 15 SP4 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP4 is installed OR SUSE Manager Proxy 4.3 is installed OR SUSE Manager Retail Branch Server 4.3 is installed OR SUSE Manager Server 4.3 is installed AND golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 is installed OR Package Information SUSE Linux Enterprise Module for SUSE Manager Proxy 4.3 is installed OR SUSE Manager Proxy 4.3 is installed AND golang-github-prometheus-alertmanager-0.23.0-150100.4.7.1 is installed Definition Synopsis Release Information SUSE Linux Enterprise Server 12 SP5 is installed OR SUSE Linux Enterprise Server for SAP Applications 12 SP5 is installed AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed Definition Synopsis Release Information SUSE Linux Enterprise Server 15 SP2-LTSS is installed AND golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 is installed OR Package Information SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS is installed OR SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS is installed AND golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 is installed OR Package Information SUSE Linux Enterprise Server 15 SP2-BCL is installed AND golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 is installed OR Package Information SUSE Linux Enterprise Server for SAP Applications 15 SP2 is installed AND golang-github-prometheus-node_exporter-1.3.0-150100.3.12.1 is installed OR podman is affected OR podman-cni-config is affected Definition Synopsis Release Information SUSE Linux Enterprise Server for SAP Applications 12 SP4 is installed AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed OR Package Information SUSE Linux Enterprise Server 12 SP4-LTSS is installed AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed OR Package Information SUSE Linux Enterprise Server 12 SP4-ESPOS is installed AND golang-github-prometheus-node_exporter-1.3.0-1.15.3 is installed Definition Synopsis Release Information SUSE Linux Enterprise Desktop 15 SP5 is installed OR SUSE Linux Enterprise High Performance Computing 15 SP5 is installed OR SUSE Linux Enterprise Module for Basesystem 15 SP5 is installed OR SUSE Linux Enterprise Server 15 SP5 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP5 is installed AND golang-github-prometheus-node_exporter-1.5.0-150100.3.23.2 is installed OR Package Information SUSE Linux Enterprise High Performance Computing 15 SP5 is installed OR SUSE Linux Enterprise Module for Containers 15 SP5 is installed OR SUSE Linux Enterprise Server 15 SP5 is installed OR SUSE Linux Enterprise Server for SAP Applications 15 SP5 is installed AND podman-4.4.4-150500.1.4 is installed OR podman-cni-config-4.4.4-150500.1.4 is installed OR podman-docker-4.4.4-150500.1.4 is installed OR podman-remote-4.4.4-150500.1.4 is installed
BACK