Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): Update module github.com/prometheus/client_golang to v1.11.1 [SECURITY] #15855

Merged
merged 1 commit into from Dec 29, 2023
Merged

fix(deps): Update module github.com/prometheus/client_golang to v1.11.1 [SECURITY] #15855

merged 1 commit into from Dec 29, 2023

Conversation

cq-bot
Copy link
Contributor

@cq-bot cq-bot commented Dec 29, 2023

This PR contains the following updates:

Package Type Update Change
github.com/prometheus/client_golang indirect minor v1.1.0 -> v1.11.1

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-21698

This is the Go client library for Prometheus. It has two separate parts, one for instrumenting application code, and one for creating clients that talk to the Prometheus HTTP API. client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

Impact

HTTP server susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods.

Affected Configuration

In order to be affected, an instrumented software must

  • Use any of promhttp.InstrumentHandler* middleware except RequestsInFlight.
  • Do not filter any specific methods (e.g GET) before middleware.
  • Pass metric with method label name to our middleware.
  • Not have any firewall/LB/proxy that filters away requests with unknown method.

Patches

Workarounds

If you cannot upgrade to v1.11.1 or above, in order to stop being affected you can:

  • Remove method label name from counter/gauge you use in the InstrumentHandler.
  • Turn off affected promhttp handlers.
  • Add custom middleware before promhttp handler that will sanitize the request method given by Go http.Request.
  • Use a reverse proxy or web application firewall, configured to only allow a limited set of methods.

For more information

If you have any questions or comments about this advisory:

Release Notes

prometheus/client_golang (github.com/prometheus/client_golang)

v1.11.1: 1.11.1 / 2022-02-15

Compare Source

What's Changed

Full Changelog: prometheus/client_golang@v1.11.0...v1.11.1

v1.11.0: / 2021-06-07

Compare Source

  • [CHANGE] Add new collectors package. #​862
  • [CHANGE] prometheus.NewExpvarCollector is deprecated, use collectors.NewExpvarCollector instead. #​862
  • [CHANGE] prometheus.NewGoCollector is deprecated, use collectors.NewGoCollector instead. #​862
  • [CHANGE] prometheus.NewBuildInfoCollector is deprecated, use collectors.NewBuildInfoCollector instead. #​862
  • [FEATURE] Add new collector for database/sql#DBStats. #​866
  • [FEATURE] API client: Add exemplars API support. #​861
  • [ENHANCEMENT] API client: Add newer fields to Rules API. #​855
  • [ENHANCEMENT] API client: Add missing fields to Targets API. #​856

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.10.0...v1.11.0

v1.10.0: 1.10.0 / 2021-03-18

Compare Source

  • [CHANGE] Minimum required Go version is now 1.13.
  • [CHANGE] API client: Add matchers to LabelNames and LabesValues. #​828
  • [FEATURE] API client: Add buildinfo call. #​841
  • [BUGFIX] Fix build on riscv64. #​833

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.9.0...v1.10.0

v1.9.0: 1.9.0 / 2020-12-17

Compare Source

  • [FEATURE] NewPidFileFn helper to create process collectors for processes whose PID is read from a file. #​804
  • [BUGFIX] promhttp: Prevent endless loop in InstrumentHandler... middlewares with invalid metric or label names. #​823

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.8.0...v1.9.0

v1.8.0: 1.8.0 / 2020-10-15

Compare Source

  • [CHANGE] API client: Use time.Time rather than string for timestamps in RuntimeinfoResult. #​777
  • [FEATURE] Export MetricVec to facilitate implementation of vectors of custom Metric types. #​803
  • [FEATURE API client: Support /status/tsdb endpoint. #​773
  • [ENHANCEMENT] API client: Enable GET fallback on status code 501. #​802
  • [ENHANCEMENT] Remove Metric references after reslicing to free up more memory. #​784

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.7.1...v1.8.0

v1.7.1: 1.7.1 / 2020-06-23

Compare Source

  • [BUGFIX] API client: Actually propagate start/end parameters of LabelNames and LabelValues. #​771

v1.7.0: 1.7.0 / 2020-06-17

Compare Source

  • [CHANGE] API client: Add start/end parameters to LabelNames and LabelValues. #​767
  • [FEATURE] testutil: Add GatherAndCount and enable filtering in CollectAndCount #​753
  • [FEATURE] API client: Add support for status and runtimeinfo endpoints. #​755
  • [ENHANCEMENT] Wrapping nil with a WrapRegistererWith... function creates a no-op Registerer. #​764
  • [ENHANCEMENT] promlint: Allow Kelvin as a base unit for cases like color temperature. #​761
  • [BUGFIX] push: Properly handle empty job and label values. #​752

v1.6.0: 1.6.0 / 2020-04-28

Compare Source

  • [FEATURE] testutil: Add lint checks for metrics, including a sub-package promlint to expose the linter engine for external usage. #​739 #​743
  • [ENHANCEMENT] API client: Improve error messages. #​731
  • [BUGFIX] process collector: Fix process_resident_memory_bytes on 32bit MS Windows. #​734

v1.5.1: 1.5.1 / 2020-03-14

Compare Source

  • [BUGFIX] promhttp: Remove another superfluous WriteHeader call.

v1.5.0: 1.5.0 / 2020-03-03

Compare Source

  • [FEATURE] promauto: Add a factory to allow automatic registration with a local registry. #​713
  • [FEATURE] promauto: Add NewUntypedFunc. #​713
  • [FEATURE] API client: Support new metadata endpoint. #​718

v1.4.1: 1.4.1 / 2020-02-07

Compare Source

  • [BUGFIX] Fix timestamp of exemplars in CounterVec. #​710

v1.4.0: 1.4.0 / 2020-01-27

Compare Source

  • [CHANGE] Go collector: Improve doc string for go_gc_duration_seconds. #​702
  • [FEATURE] Support a subset of OpenMetrics, including exemplars. Needs opt-in via promhttp.HandlerOpts. EXPERIMENTAL #​706
  • [FEATURE] Add testutil.CollectAndCount. #​703

v1.3.0: 1.3.0 / 2019-12-21

Compare Source

  • [FEATURE] Support tags in Graphite bridge. #​668
  • [BUGFIX] API client: Actually return Prometheus warnings. #​699

v1.2.1: 1.2.1 / 2019-10-17

Compare Source

1.2.1 / 2019-10-17

  • [BUGFIX] Fix regression in the implementation of Registerer.Unregister. #​663

v1.2.0: 1.2.0 / 2019-10-15

Compare Source

  • [FEATURE] Support pushing to Pushgateway v0.10+. #​652
  • [ENHANCEMENT] Improve hashing to make a spurious AlreadyRegisteredError less likely to occur. #​657
  • [ENHANCEMENT] API client: Add godoc examples. #​630
  • [BUGFIX] promhttp: Correctly call WriteHeader in HTTP middleware. #​634

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@cq-bot cq-bot added automerge Automatically merge once required checks pass security area/cli labels Dec 29, 2023
@kodiakhq kodiakhq bot merged commit 676805b into main Dec 29, 2023
13 checks passed
@kodiakhq kodiakhq bot deleted the renovate/go-github.com/prometheus/client_golang-vulnerability branch December 29, 2023 11:11
@cq-bot cq-bot mentioned this pull request Dec 29, 2023
Merged
kodiakhq bot pushed a commit that referenced this pull request Jan 2, 2024
@cq-bot
chore(main): Release cli v4.4.0 (#15852)
475e5f9 
🤖 I have created a release *beep* *boop*
---


## [4.4.0](cli-v4.3.6...cli-v4.4.0) (2024-01-02)


### Features

* Offline licensing support ([#15831](#15831)) ([7eab631](7eab631))
* Support publishing to a private docker registry ([#15698](#15698)) ([36e0351](36e0351))


### Bug Fixes

* **deps:** Update github.com/apache/arrow/go/v15 digest to 7c3480e ([#15904](#15904)) ([a3ec012](a3ec012))
* **deps:** Update github.com/gomarkdown/markdown digest to 1d6d208 ([#15907](#15907)) ([86d29a9](86d29a9))
* **deps:** Update golang.org/x/exp digest to 02704c9 ([#15909](#15909)) ([dfe32d2](dfe32d2))
* **deps:** Update module github.com/cloudquery/plugin-pb-go to v1.15.0 ([#15851](#15851)) ([f51f12d](f51f12d))
* **deps:** Update module github.com/cloudquery/plugin-pb-go to v1.16.0 ([#15856](#15856)) ([0d63c66](0d63c66))
* **deps:** Update module github.com/cloudquery/plugin-sdk/v4 to v4.24.0 ([#15863](#15863)) ([47d7899](47d7899))
* **deps:** Update module github.com/prometheus/client_golang to v1.11.1 [SECURITY] ([#15855](#15855)) ([676805b](676805b))

---
This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kodiakhq kodiakhq[bot] kodiakhq approved these changes

Assignees
No one assigned
Labels
area/cli automerge Automatically merge once required checks pass security
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@cq-bot @renovate-bot