{"schema_version":"1.7.3","id":"SUSE-SU-2025:01987-1","published":"2025-06-18T02:09:10Z","modified":"2026-02-04T02:32:42.592727Z","related":["CVE-2023-45288","CVE-2024-9264","CVE-2024-9476","CVE-2025-22870","CVE-2025-22872","CVE-2025-2703","CVE-2025-29923","CVE-2025-3454"],"upstream":["CVE-2023-45288","CVE-2024-9264","CVE-2024-9476","CVE-2025-22870","CVE-2025-22872","CVE-2025-2703","CVE-2025-29923","CVE-2025-3454"],"summary":"Security update for Multi-Linux Manager Client Tools","details":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 2.53.4:\n    \n- Security issues fixed:\n  * CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)\n  * CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)\n\n- Other bugs fixes from version 2.53.4:   \n  * Runtime: fixed GOGC being set to 0 when installed\n    with empty prometheus.yml file resulting high cpu usage\n  * Scrape: fixed dropping valid metrics after previous\n    scrape failed\n    \nprometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):   \n\n- Security issues fixed:\n  * CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)\n  * CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)\n\n- Other changes from version 0.26.0:\n  * Changes:\n    + Replace go-kit/log with log/slog module.\n  * Features:\n    + Add metric to record tls ciphersuite negotiated during\n      handshake.\n    + Add a way to export labels with content matched by the probe.\n      Reports Certificate Serial number.\n  * Enhancement:\n    + Add stale workflow to start sync with stale.yaml in Prometheus.\n  * Bug fixes:\n    + Only register grpc TLS metrics on successful handshake.\n\n- Other changes from version 0.25.0:\n  * Features:\n    + Allow to get Probe logs by target.\n    + Log errors from probe.\n  * Bug fixes:\n    + Prevent logging confusing error message.\n    + Explicit registration of internal exporter metrics.\n\ngrafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):\n\n- Security issues fixed:\n  * CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).\n  * CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)\n  * CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).\n  * CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.\n  * CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).\n  * CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).\n  * CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).\n  * CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)\n  * CVE-2024-9264: SQL Expressions (bsc#1231844)\n  * CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)\n  * CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)\n\n- Potential breaking changes in version 11.5.0:\n  * Loki: Default to /labels API with query param instead of /series API.\n\n- Potential breaking changes in version 11.0.1:\n  * If you had selected your language as 'Portugu�s Brasileiro'\n    previously, this will be reset. You have to select it again in\n    your Preferences for the fix to be applied and the translations\n    will then be shown.\n\n- Potential breaking changes in version 11.0.0:\n  * AngularJS support is turned off by default.\n  * Legacy alerting is entirely removed.\n  * Subfolders cause very rare issues with folders which have\n    slashes in their names.\n  * The input data source is removed.\n  * Data sources: Responses which are associated with hidden\n    queries will be removed (filtered) by Grafana.\n  * The URL which is generated when viewing an individual repeated\n    panel has changed.\n  * React Router is deprecated.\n  * The grafana/e2e testing tool is deprecated.\n    \n- This update brings many new features, enhancements and fixes highlighted at:\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/\n    \ngolang-github-prometheus-node_exporter was updated to version 1.9.1:\n    \n- Security issues fixed:\n  * CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)\n   \n- Other changes from version 1.9.1:\n  * pressure: Fix missing IRQ on older kernels\n  * Fix Darwin memory leak\n    \ngolang-github-prometheus-alertmanager:\n    \n- Security issues fixed: \n  * CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238686)\n  * CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516)\n  ","affected":[{"package":{"name":"golang-github-prometheus-alertmanager","ecosystem":"SUSE:Manager Client Tools 12","purl":"pkg:rpm/suse/golang-github-prometheus-alertmanager&distro=SUSE%20Manager%20Client%20Tools%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-1.31.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.26.0-1.31.2","golang-github-prometheus-node_exporter":"1.9.1-1.36.2","golang-github-prometheus-prometheus":"2.53.4-1.60.2","grafana":"11.5.5-1.79.2","prometheus-blackbox_exporter":"0.26.0-1.27.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:01987-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Manager Client Tools 12","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Manager%20Client%20Tools%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.36.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.26.0-1.31.2","golang-github-prometheus-node_exporter":"1.9.1-1.36.2","golang-github-prometheus-prometheus":"2.53.4-1.60.2","grafana":"11.5.5-1.79.2","prometheus-blackbox_exporter":"0.26.0-1.27.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:01987-1.json"}},{"package":{"name":"golang-github-prometheus-prometheus","ecosystem":"SUSE:Manager Client Tools 12","purl":"pkg:rpm/suse/golang-github-prometheus-prometheus&distro=SUSE%20Manager%20Client%20Tools%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.4-1.60.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.26.0-1.31.2","golang-github-prometheus-node_exporter":"1.9.1-1.36.2","golang-github-prometheus-prometheus":"2.53.4-1.60.2","grafana":"11.5.5-1.79.2","prometheus-blackbox_exporter":"0.26.0-1.27.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:01987-1.json"}},{"package":{"name":"grafana","ecosystem":"SUSE:Manager Client Tools 12","purl":"pkg:rpm/suse/grafana&distro=SUSE%20Manager%20Client%20Tools%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.5.5-1.79.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.26.0-1.31.2","golang-github-prometheus-node_exporter":"1.9.1-1.36.2","golang-github-prometheus-prometheus":"2.53.4-1.60.2","grafana":"11.5.5-1.79.2","prometheus-blackbox_exporter":"0.26.0-1.27.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:01987-1.json"}},{"package":{"name":"prometheus-blackbox_exporter","ecosystem":"SUSE:Manager Client Tools 12","purl":"pkg:rpm/suse/prometheus-blackbox_exporter&distro=SUSE%20Manager%20Client%20Tools%2012"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-1.27.1"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-alertmanager":"0.26.0-1.31.2","golang-github-prometheus-node_exporter":"1.9.1-1.36.2","golang-github-prometheus-prometheus":"2.53.4-1.60.2","grafana":"11.5.5-1.79.2","prometheus-blackbox_exporter":"0.26.0-1.27.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:01987-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.36.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-1.36.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:01987-1.json"}},{"package":{"name":"golang-github-prometheus-node_exporter","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","purl":"pkg:rpm/suse/golang-github-prometheus-node_exporter&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1.36.2"}]}],"ecosystem_specific":{"binaries":[{"golang-github-prometheus-node_exporter":"1.9.1-1.36.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:01987-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501987-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1208752"},{"type":"REPORT","url":"https://bugzilla.suse.com/1231844"},{"type":"REPORT","url":"https://bugzilla.suse.com/1233343"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236510"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236515"},{"type":"REPORT","url":"https://bugzilla.suse.com/1236516"},{"type":"REPORT","url":"https://bugzilla.suse.com/1238680"},{"type":"REPORT","url":"https://bugzilla.suse.com/1238686"},{"type":"REPORT","url":"https://bugzilla.suse.com/1238703"},{"type":"REPORT","url":"https://bugzilla.suse.com/1241683"},{"type":"REPORT","url":"https://bugzilla.suse.com/1241687"},{"type":"REPORT","url":"https://bugzilla.suse.com/1241809"},{"type":"REPORT","url":"https://bugzilla.suse.com/1243672"},{"type":"REPORT","url":"https://bugzilla.suse.com/1243714"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-45288"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-9264"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2024-9476"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22870"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22872"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-2703"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-29923"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-3454"}]}