Vulnerability · Published Feb 15, 2022 · Assigned by GitHub_M
CVE-2022-21698Uncontrolled Resource Consumption in promhttp
High 7.5
In plain English
A high-severity uncontrolled resource consumption in client_golang from prometheus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 6.0% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)6.0%top 6.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | aardvark-dns | 2:1.0.1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | buildah | 1:1.24.2-4.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | buildah | 1.19.9-6.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | buildah-tests | 1.19.9-6.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | buildah-tests | 1:1.24.2-4.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | cockpit-podman | 29-2.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | cockpit-podman | 43-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | conmon | 2:2.0.26-3.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | conmon | 2:2.1.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | container-selinux | 2:2.189.0-1.module_el8.6.0+3336+00d107d5 | ALSA-2022:7529 |
| AlmaLinux:8 | container-selinux | 2:2.179.1-1.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | container-selinux | 2:2.189.0-1.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | container-selinux | 2:2.189.0-1.module_el8.7.0+3406+a17c4180 | ALSA-2022:7529 |
| AlmaLinux:8 | containernetworking-plugins | 0.9.1-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | containernetworking-plugins | 1:1.0.1-2.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | containernetworking-plugins | 0.9.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | containers-common | 1:1.2.4-2.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | containers-common | 2:1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | crit | 3.15-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | crit | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | crit | 3.15-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu | 3.15-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-devel | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | criu-libs | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | crun | 1.4.4-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | crun | 0.18-3.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | crun | 0.18-3.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | fuse-overlayfs | 1.4.0-2.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | fuse-overlayfs | 1.4.0-2.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | fuse-overlayfs | 1.8.2-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | grafana | 7.5.15-3.el8 | ALSA-2022:7519 |
| AlmaLinux:9 | grafana | 7.5.15-3.el9 | ALSA-2022:8057 |
| AlmaLinux:8 | libslirp | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | libslirp | 4.3.1-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | libslirp | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | libslirp-devel | 4.3.1-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | libslirp-devel | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | libslirp-devel | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | netavark | 2:1.0.1-27.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.3-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.0-3.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | oci-seccomp-bpf-hook | 1.2.0-3.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | podman | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman | 3.0.1-13.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | podman-catatonit | 3.0.1-13.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | podman-catatonit | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-docker | 3.0.1-13.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | podman-docker | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-gvproxy | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-plugins | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-plugins | 3.0.1-13.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | podman-remote | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-remote | 3.0.1-13.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | podman-tests | 2:4.0.2-6.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | podman-tests | 3.0.1-13.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2751+06427ca3 | ALSA-2022:1762 |
| AlmaLinux:8 | python3-criu | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | python3-criu | 3.15-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | python3-criu | 3.15-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | python3-podman | 4.0.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | runc | 1.0.0-73.rc95.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | runc | 1:1.0.3-2.module_el8.6.0+2878+e681bc44 | ALSA-2022:1762 |
| AlmaLinux:8 | runc | 1.0.0-73.rc95.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | skopeo | 1:1.2.4-2.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | skopeo | 2:1.6.1-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | skopeo-tests | 2:1.6.1-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | skopeo-tests | 1:1.2.4-2.module_el8.7.0+3297+1eb250cf | ALSA-2022:7529 |
| AlmaLinux:8 | slirp4netns | 1.1.8-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | slirp4netns | 1.1.8-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | slirp4netns | 1.1.8-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | toolbox | 0.0.99.3-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | toolbox | 0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | toolbox | 0.0.99.3-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.3-0.4.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.3-1.module_el8.6.0+3136+bfcd65b6 | ALSA-2022:7529 |
| AlmaLinux:8 | toolbox-tests | 0.0.99.3-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| AlmaLinux:8 | udica | 0.2.6-2.module_el8.6.0+2877+8e437bf5 | ALSA-2022:1762 |
| AlmaLinux:8 | udica | 0.2.4-1.module_el8.6.0+2876+9ed4eae2 | ALSA-2022:7529 |
| Debian:12 | golang-github-prometheus-client-golang | 1.11.1-1 | DEBIAN-CVE-2022-21698 |
| Debian:13 | golang-github-prometheus-client-golang | 1.11.1-1 | DEBIAN-CVE-2022-21698 |
| Debian:14 | golang-github-prometheus-client-golang | 1.11.1-1 | DEBIAN-CVE-2022-21698 |
| Go | github.com/prometheus/client_golang | 1.11.1 | GHSA-cg3q-j54f-5p7p |
| Go | github.com/prometheus/client_golang | 1.11.1 | GO-2022-0322 |
| Rocky Linux:8 | buildah | 1:1.24.2-4.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | buildah | 0:1.19.9-6.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | cockpit-podman | 0:43-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.4.0+556+40122d08 | RLSA-2022:7529 |
| Rocky Linux:8 | cockpit-podman | 0:29-2.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | conmon | 2:2.1.0-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | conmon | 2:2.0.26-3.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | conmon | 2:2.0.26-3.module+el8.4.0+556+40122d08 | RLSA-2022:7529 |
| Rocky Linux:8 | container-selinux | 2:2.189.0-1.module+el8.6.0+1054+50b00ff4 | RLSA-2022:7529 |
| Rocky Linux:8 | container-selinux | 2:2.179.1-1.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | container-selinux | 2:2.189.0-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.4.0+556+40122d08 | RLSA-2022:7529 |
| Rocky Linux:8 | containernetworking-plugins | 0:0.9.1-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | containernetworking-plugins | 1:1.0.1-2.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | containers-common | 2:1-27.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.6.0+1054+50b00ff4 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.4.0+556+40122d08 | RLSA-2022:7529 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | criu | 0:3.15-3.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | criu | 0:3.15-1.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | crun | 0:0.18-3.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | crun | 0:1.4.4-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | crun | 0:0.18-3.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.8.2-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | fuse-overlayfs | 0:1.4.0-2.module+el8.4.0+558+7340b765 | RLSA-2022:7529 |
| Rocky Linux:8 | grafana | 0:7.5.15-3.el8 | RLSA-2022:7519 |
| Rocky Linux:9 | grafana | 0:7.5.15-3.el9 | RLSA-2022:8057 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.6.0+1054+50b00ff4 | RLSA-2022:1762 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | libslirp | 0:4.4.0-1.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.4.0+556+40122d08 | RLSA-2022:7529 |
| Rocky Linux:8 | libslirp | 0:4.3.1-1.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.3-3.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.0-3.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.0-3.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.0-3.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | oci-seccomp-bpf-hook | 0:1.2.3-3.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | podman | 2:4.0.2-6.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | podman | 0:3.0.1-13.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | python-podman | 0:4.0.0-1.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | python-podman | 0:4.0.0-1.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | runc | 0:1.0.0-73.rc95.module+el8.5.0+769+55ca48e8 | RLSA-2022:7529 |
| Rocky Linux:8 | runc | 1:1.0.3-2.module+el8.6.0+785+d1251653 | RLSA-2022:1762 |
| Rocky Linux:8 | runc | 0:1.0.0-73.rc95.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | runc | 0:1.0.0-73.rc95.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | skopeo | 1:1.2.4-2.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | skopeo | 2:1.6.1-2.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-2.module+el8.7.0+1077+0e4f03d4 | RLSA-2022:1762 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-2.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.4.0+537+38cf4e42 | RLSA-2022:7529 |
| Rocky Linux:8 | slirp4netns | 0:1.1.8-1.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-0.4.module+el8.5.0+710+4c471e88 | RLSA-2022:1762 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-0.4.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-1.module+el8.5.0+734+8397cf81 | RLSA-2022:7529 |
| Rocky Linux:8 | toolbox | 0:0.0.99.3-1.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.6.0+783+10209741 | RLSA-2022:7529 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.7.0+1076+9b1c11c1 | RLSA-2022:7529 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.4.0+556+40122d08 | RLSA-2022:7529 |
| Rocky Linux:8 | udica | 0:0.2.4-1.module+el8.5.0+709+440d5e7e | RLSA-2022:7529 |
| Rocky Linux:8 | udica | 0:0.2.6-2.module+el8.6.0+784+32aef5de | RLSA-2022:1762 |
| Ubuntu:22.04:LTS | golang-github-prometheus-client-golang | no fix listed | UBUNTU-CVE-2022-21698 |
| Ubuntu:24.04:LTS | golang-github-prometheus-client-golang | no fix listed | UBUNTU-CVE-2022-21698 |
| Ubuntu:25.10 | golang-github-prometheus-client-golang | no fix listed | UBUNTU-CVE-2022-21698 |
| Ubuntu:26.04:LTS | golang-github-prometheus-client-golang | no fix listed | UBUNTU-CVE-2022-21698 |
| Ubuntu:26.10 | golang-github-prometheus-client-golang | no fix listed | UBUNTU-CVE-2022-21698 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| prometheus | client_golang | < 1.11.1 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p
- https://github.com/prometheus/client_golang/pull/962
- https://github.com/prometheus/client_golang/pull/987
- https://github.com/prometheus/client_golang/releases/tag/v1.11.1
- FEDORA-2022-5f253807ce vendor-advisory
- FEDORA-2022-6c4cb64314 vendor-advisory
- FEDORA-2022-eda0e65b01 vendor-advisory
- FEDORA-2022-6043a7b938 vendor-advisory
- FEDORA-2022-e244ad73d6 vendor-advisory
- FEDORA-2022-a7d438b30b vendor-advisory
- FEDORA-2022-83405f9d5b vendor-advisory
- FEDORA-2022-9dd03cab55 vendor-advisory
- FEDORA-2022-c87047f163 vendor-advisory
- FEDORA-2022-2067702f06 vendor-advisory
- FEDORA-2022-c5383675d9 vendor-advisory
- FEDORA-2022-5e637f6cc6 vendor-advisory
- FEDORA-2022-396c568c5e vendor-advisory
- FEDORA-2022-92ef43c439 vendor-advisory
- FEDORA-2022-fae3ecee19 vendor-advisory
- FEDORA-2022-739c7a0058 vendor-advisory
- FEDORA-2022-13ad572b5a vendor-advisory
- FEDORA-2022-741325e9a0 vendor-advisory