USN-6935-1: Prometheus Alertmanager vulnerability
It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code. On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only present if the UI has been explicitly activated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of USN-6935-1?
The severity of USN-6935-1 is classified as high due to the potential for arbitrary code injection through an API endpoint.
How do I fix USN-6935-1?
To fix USN-6935-1, update the prometheus-alertmanager package to version 0.23.0-4ubuntu0.2+esm1 for Ubuntu 22.04 LTS or 0.15.3+ds-3ubuntu1.2 for Ubuntu 20.04 LTS.
Which versions of Ubuntu are affected by USN-6935-1?
USN-6935-1 affects Ubuntu 18.04 LTS, 20.04 LTS, and 22.04 LTS using specific versions of the prometheus-alertmanager package.
What is the nature of the vulnerability in USN-6935-1?
The vulnerability in USN-6935-1 stems from improper input sanitization in an API endpoint used by prometheus-alertmanager, allowing for potential code injection.
Is it necessary to reboot my system after applying the fix for USN-6935-1?
Typically, a reboot is not required after fixing USN-6935-1, but it is recommended to restart the prometheus-alertmanager service to ensure the changes take effect.