Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Résumé
Prometheus Exporter Toolkit vulnerable to basic authentication bypass
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2022-46146 golang-github-prometheus-exporter-toolkit Corrigé dans: 0.5.1-2+deb11u2
- Ubuntu UBUNTU-CVE-2022-46146 prometheus
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.gentoo.org
- advisory github.com
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- package github.com
- patch github.com
- web github.com
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org
- web openwall.com
- web openwall.com
- web openwall.com