Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update module github.com/prometheus/client_golang to v1.11.1 [SECURITY] #14

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update module github.com/prometheus/client_golang to v1.11.1 [SECURITY] #14

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Aug 6, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/prometheus/client_golang v1.2.1 -> v1.11.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-21698

This is the Go client library for Prometheus. It has two separate parts, one for instrumenting application code, and one for creating clients that talk to the Prometheus HTTP API. client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

Impact

HTTP server susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods.

Affected Configuration

In order to be affected, an instrumented software must

  • Use any of promhttp.InstrumentHandler* middleware except RequestsInFlight.
  • Do not filter any specific methods (e.g GET) before middleware.
  • Pass metric with method label name to our middleware.
  • Not have any firewall/LB/proxy that filters away requests with unknown method.

Patches

Workarounds

If you cannot upgrade to v1.11.1 or above, in order to stop being affected you can:

  • Remove method label name from counter/gauge you use in the InstrumentHandler.
  • Turn off affected promhttp handlers.
  • Add custom middleware before promhttp handler that will sanitize the request method given by Go http.Request.
  • Use a reverse proxy or web application firewall, configured to only allow a limited set of methods.

For more information

If you have any questions or comments about this advisory:

Release Notes

prometheus/client_golang (github.com/prometheus/client_golang)

v1.11.1: 1.11.1 / 2022-02-15

Compare Source

What's Changed

Full Changelog: prometheus/client_golang@v1.11.0...v1.11.1

v1.11.0: / 2021-06-07

Compare Source

  • [CHANGE] Add new collectors package. #​862
  • [CHANGE] prometheus.NewExpvarCollector is deprecated, use collectors.NewExpvarCollector instead. #​862
  • [CHANGE] prometheus.NewGoCollector is deprecated, use collectors.NewGoCollector instead. #​862
  • [CHANGE] prometheus.NewBuildInfoCollector is deprecated, use collectors.NewBuildInfoCollector instead. #​862
  • [FEATURE] Add new collector for database/sql#DBStats. #​866
  • [FEATURE] API client: Add exemplars API support. #​861
  • [ENHANCEMENT] API client: Add newer fields to Rules API. #​855
  • [ENHANCEMENT] API client: Add missing fields to Targets API. #​856

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.10.0...v1.11.0

v1.10.0: 1.10.0 / 2021-03-18

Compare Source

  • [CHANGE] Minimum required Go version is now 1.13.
  • [CHANGE] API client: Add matchers to LabelNames and LabesValues. #​828
  • [FEATURE] API client: Add buildinfo call. #​841
  • [BUGFIX] Fix build on riscv64. #​833

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.9.0...v1.10.0

v1.9.0: 1.9.0 / 2020-12-17

Compare Source

  • [FEATURE] NewPidFileFn helper to create process collectors for processes whose PID is read from a file. #​804
  • [BUGFIX] promhttp: Prevent endless loop in InstrumentHandler... middlewares with invalid metric or label names. #​823

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.8.0...v1.9.0

v1.8.0: 1.8.0 / 2020-10-15

Compare Source

  • [CHANGE] API client: Use time.Time rather than string for timestamps in RuntimeinfoResult. #​777
  • [FEATURE] Export MetricVec to facilitate implementation of vectors of custom Metric types. #​803
  • [FEATURE API client: Support /status/tsdb endpoint. #​773
  • [ENHANCEMENT] API client: Enable GET fallback on status code 501. #​802
  • [ENHANCEMENT] Remove Metric references after reslicing to free up more memory. #​784

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.7.1...v1.8.0

v1.7.1: 1.7.1 / 2020-06-23

Compare Source

  • [BUGFIX] API client: Actually propagate start/end parameters of LabelNames and LabelValues. #​771

v1.7.0: 1.7.0 / 2020-06-17

Compare Source

  • [CHANGE] API client: Add start/end parameters to LabelNames and LabelValues. #​767
  • [FEATURE] testutil: Add GatherAndCount and enable filtering in CollectAndCount #​753
  • [FEATURE] API client: Add support for status and runtimeinfo endpoints. #​755
  • [ENHANCEMENT] Wrapping nil with a WrapRegistererWith... function creates a no-op Registerer. #​764
  • [ENHANCEMENT] promlint: Allow Kelvin as a base unit for cases like color temperature. #​761
  • [BUGFIX] push: Properly handle empty job and label values. #​752

v1.6.0: 1.6.0 / 2020-04-28

Compare Source

  • [FEATURE] testutil: Add lint checks for metrics, including a sub-package promlint to expose the linter engine for external usage. #​739 #​743
  • [ENHANCEMENT] API client: Improve error messages. #​731
  • [BUGFIX] process collector: Fix process_resident_memory_bytes on 32bit MS Windows. #​734

v1.5.1: 1.5.1 / 2020-03-14

Compare Source

  • [BUGFIX] promhttp: Remove another superfluous WriteHeader call.

v1.5.0: 1.5.0 / 2020-03-03

Compare Source

  • [FEATURE] promauto: Add a factory to allow automatic registration with a local registry. #​713
  • [FEATURE] promauto: Add NewUntypedFunc. #​713
  • [FEATURE] API client: Support new metadata endpoint. #​718

v1.4.1: 1.4.1 / 2020-02-07

Compare Source

  • [BUGFIX] Fix timestamp of exemplars in CounterVec. #​710

v1.4.0: 1.4.0 / 2020-01-27

Compare Source

  • [CHANGE] Go collector: Improve doc string for go_gc_duration_seconds. #​702
  • [FEATURE] Support a subset of OpenMetrics, including exemplars. Needs opt-in via promhttp.HandlerOpts. EXPERIMENTAL #​706
  • [FEATURE] Add testutil.CollectAndCount. #​703

v1.3.0: 1.3.0 / 2019-12-21

Compare Source

  • [FEATURE] Support tags in Graphite bridge. #​668
  • [BUGFIX] API client: Actually return Prometheus warnings. #​699

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants