Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update module github.com/prometheus/client_golang to v1 [security] - autoclosed #102

Closed
wants to merge 1 commit into from
Closed

fix(deps): update module github.com/prometheus/client_golang to v1 [security] - autoclosed #102

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Mar 16, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change
github.com/prometheus/client_golang require major v0.9.1 -> v1.11.1

GitHub Vulnerability Alerts

CVE-2022-21698

This is the Go client library for Prometheus. It has two separate parts, one for instrumenting application code, and one for creating clients that talk to the Prometheus HTTP API. client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

Impact

HTTP server susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods.

Affected Configuration

In order to be affected, an instrumented software must

  • Use any of promhttp.InstrumentHandler* middleware except RequestsInFlight.
  • Do not filter any specific methods (e.g GET) before middleware.
  • Pass metric with method label name to our middleware.
  • Not have any firewall/LB/proxy that filters away requests with unknown method.

Patches

Workarounds

If you cannot upgrade to v1.11.1 or above, in order to stop being affected you can:

  • Remove method label name from counter/gauge you use in the InstrumentHandler.
  • Turn off affected promhttp handlers.
  • Add custom middleware before promhttp handler that will sanitize the request method given by Go http.Request.
  • Use a reverse proxy or web application firewall, configured to only allow a limited set of methods.

For more information

If you have any questions or comments about this advisory:

Release Notes

prometheus/client_golang

v1.11.1: 1.11.1 / 2022-02-15

Compare Source

What's Changed

Full Changelog: prometheus/client_golang@v1.11.0...v1.11.1

v1.11.0: / 2021-06-07

Compare Source

  • [CHANGE] Add new collectors package. #​862
  • [CHANGE] prometheus.NewExpvarCollector is deprecated, use collectors.NewExpvarCollector instead. #​862
  • [CHANGE] prometheus.NewGoCollector is deprecated, use collectors.NewGoCollector instead. #​862
  • [CHANGE] prometheus.NewBuildInfoCollector is deprecated, use collectors.NewBuildInfoCollector instead. #​862
  • [FEATURE] Add new collector for database/sql#DBStats. #​866
  • [FEATURE] API client: Add exemplars API support. #​861
  • [ENHANCEMENT] API client: Add newer fields to Rules API. #​855
  • [ENHANCEMENT] API client: Add missing fields to Targets API. #​856

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.10.0...v1.11.0

v1.10.0: 1.10.0 / 2021-03-18

Compare Source

  • [CHANGE] Minimum required Go version is now 1.13.
  • [CHANGE] API client: Add matchers to LabelNames and LabesValues. #​828
  • [FEATURE] API client: Add buildinfo call. #​841
  • [BUGFIX] Fix build on riscv64. #​833

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.9.0...v1.10.0

v1.9.0: 1.9.0 / 2020-12-17

Compare Source

  • [FEATURE] NewPidFileFn helper to create process collectors for processes whose PID is read from a file. #​804
  • [BUGFIX] promhttp: Prevent endless loop in InstrumentHandler... middlewares with invalid metric or label names. #​823

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.8.0...v1.9.0

v1.8.0: 1.8.0 / 2020-10-15

Compare Source

  • [CHANGE] API client: Use time.Time rather than string for timestamps in RuntimeinfoResult. #​777
  • [FEATURE] Export MetricVec to facilitate implementation of vectors of custom Metric types. #​803
  • [FEATURE API client: Support /status/tsdb endpoint. #​773
  • [ENHANCEMENT] API client: Enable GET fallback on status code 501. #​802
  • [ENHANCEMENT] Remove Metric references after reslicing to free up more memory. #​784

What's Changed

New Contributors

Full Changelog: prometheus/client_golang@v1.7.1...v1.8.0

v1.7.1: 1.7.1 / 2020-06-23

Compare Source

  • [BUGFIX] API client: Actually propagate start/end parameters of LabelNames and LabelValues. #​771

v1.7.0: 1.7.0 / 2020-06-17

Compare Source

  • [CHANGE] API client: Add start/end parameters to LabelNames and LabelValues. #​767
  • [FEATURE] testutil: Add GatherAndCount and enable filtering in CollectAndCount #​753
  • [FEATURE] API client: Add support for status and runtimeinfo endpoints. #​755
  • [ENHANCEMENT] Wrapping nil with a WrapRegistererWith... function creates a no-op Registerer. #​764
  • [ENHANCEMENT] promlint: Allow Kelvin as a base unit for cases like color temperature. #​761
  • [BUGFIX] push: Properly handle empty job and label values. #​752

v1.6.0: 1.6.0 / 2020-04-28

Compare Source

  • [FEATURE] testutil: Add lint checks for metrics, including a sub-package promlint to expose the linter engine for external usage. #​739 #​743
  • [ENHANCEMENT] API client: Improve error messages. #​731
  • [BUGFIX] process collector: Fix process_resident_memory_bytes on 32bit MS Windows. #​734

v1.5.1: 1.5.1 / 2020-03-14

Compare Source

  • [BUGFIX] promhttp: Remove another superfluous WriteHeader call.

v1.5.0: 1.5.0 / 2020-03-03

Compare Source

  • [FEATURE] promauto: Add a factory to allow automatic registration with a local registry. #​713
  • [FEATURE] promauto: Add NewUntypedFunc. #​713
  • [FEATURE] API client: Support new metadata endpoint. #​718

v1.4.1: 1.4.1 / 2020-02-07

Compare Source

  • [BUGFIX] Fix timestamp of exemplars in CounterVec. #​710

v1.4.0: 1.4.0 / 2020-01-27

Compare Source

  • [CHANGE] Go collector: Improve doc string for go_gc_duration_seconds. #​702
  • [FEATURE] Support a subset of OpenMetrics, including exemplars. Needs opt-in via promhttp.HandlerOpts. EXPERIMENTAL #​706
  • [FEATURE] Add testutil.CollectAndCount. #​703

v1.3.0: 1.3.0 / 2019-12-21

Compare Source

  • [FEATURE] Support tags in Graphite bridge. #​668
  • [BUGFIX] API client: Actually return Prometheus warnings. #​699

v1.2.1: 1.2.1 / 2019-10-17

Compare Source

1.2.1 / 2019-10-17

  • [BUGFIX] Fix regression in the implementation of Registerer.Unregister. #​663

v1.2.0: 1.2.0 / 2019-10-15

Compare Source

  • [FEATURE] Support pushing to Pushgateway v0.10+. #​652
  • [ENHANCEMENT] Improve hashing to make a spurious AlreadyRegisteredError less likely to occur. #​657
  • [ENHANCEMENT] API client: Add godoc examples. #​630
  • [BUGFIX] promhttp: Correctly call WriteHeader in HTTP middleware. #​634

v1.1.0: 1.1.0 / 2019-08-01

Compare Source

  • [CHANGE] API client: Format time as UTC rather than RFC3339Nano. #​617
  • [CHANGE] API client: Add warnings to LabelValues and LabelNames calls. #​609
  • [FEATURE] Push: Support base64 encoding in grouping key. #​624
  • [FEATURE] Push: Add Delete method to Pusher. #​613

v1.0.0: 1.0.0 / 2019-06-15

This release removes all previously deprecated features, resulting in the breaking changes listed below. As this is v1.0.0, semantic versioning applies from now on, with the exception of the API client and parts marked explicitly as experimental.

  • [CHANGE] Remove objectives from the default Summary. (Objectives have to be set explicitly in the SummaryOpts.) #​600
  • [CHANGE] Remove all HTTP related feature in the prometheus package. (Use the promhttp package instead.) #​600
  • [CHANGE] Remove push.FromGatherer, push.AddFromGatherer, push.Collectors. (Use push.New instead.) #​600
  • [CHANGE] API client: Pass warnings through on non-error responses. #​599
  • [CHANGE] API client: Add warnings to Series call. #​603
  • [FEATURE] Make process collector work on Microsoft Windows. EXPERIMENTAL #​596
  • [FEATURE] API client: Add /labels call. #​604
  • [BUGFIX] Make AlreadyRegisteredError usable for wrapped registries. #​607

v0.9.4: 0.9.4 / 2019-06-07

Compare Source

  • [CHANGE] API client: Switch to alert values as strings. #​585
  • [FEATURE] Add a collector for Go module build information. #​595
  • [FEATURE] promhttp: Add an counter for internal errors during HTTP exposition. #​594
  • [FEATURE] API client: Support target metadata API. #​590
  • [FEATURE] API client: Support storage warnings. #​562
  • [ENHANCEMENT] API client: Improve performance handling JSON. #​570
  • [BUGFIX] Reduce test flakiness. #​573

v0.9.3: 0.9.3 / 2019-05-16

Compare Source

  • [CHANGE] Required Go version is now 1.9+. #​561
  • [FEATURE] API client: Add POST with get fallback for Query/QueryRange. #​557
  • [FEATURE] API client: Add alerts endpoint. #​552
  • [FEATURE] API client: Add rules endpoint. #​508
  • [FEATURE] push: Add option to pick metrics format. #​540
  • [ENHANCEMENT] Limit time the Go collector may take to collect memstats,
    returning results from the previous collection in case of a timeout. #​568
  • [ENHANCEMENT] Pusher now requires only a thin interface instead of a full
    http.Client, facilitating mocking and custom HTTP client implementation.
    #​559
  • [ENHANCEMENT] Memory usage improvement for histograms and summaries without
    objectives. #​536
  • [ENHANCEMENT] Summaries without objectives are now lock-free. #​521
  • [BUGFIX] promhttp: InstrumentRoundTripperTrace now takes into account a pre-set context. #​582
  • [BUGFIX] TestCounterAddLarge now works on all platforms. #​567
  • [BUGFIX] Fix promhttp examples. #​535 #​544
  • [BUGFIX] API client: Wait for done before writing to shared response
    body. #​532
  • [BUGFIX] API client: Deal with discovered labels properly. #​529

v0.9.2: 0.9.2 / 2018-12-06

Compare Source

  • [FEATURE] Support for Go modules. #​501
  • [FEATURE] Timer.ObserveDuration returns observed duration. #​509
  • [ENHANCEMENT] Improved doc comments and error messages. #​504
  • [BUGFIX] Fix race condition during metrics gathering. #​512
  • [BUGFIX] Fix testutil metric comparison for Histograms and empty labels. #​494 #​498

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@coveralls
Copy link

Coverage Status

Coverage: 59.257% (-0.0%) from 59.257% when pulling 9fc2b9d on renovate/go-github.com/prometheus/client_golang-vulnerability into 94fb990 on master.

@renovate renovate bot changed the title fix(deps): update module github.com/prometheus/client_golang to v1 [security] fix(deps): update module github.com/prometheus/client_golang to v1 [security] - autoclosed May 12, 2023
@renovate renovate bot closed this May 12, 2023
@renovate renovate bot deleted the renovate/go-github.com/prometheus/client_golang-vulnerability branch May 12, 2023 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@coveralls