- Vulnerability/
- USN-6935-1
USN-6935-1: Prometheus Alertmanager vulnerability
First published: Wed Jul 31 2024(Updated: )
It was discovered that prometheus-alertmanager didn't properly sanitize input it received through an API endpoint. An attacker with permission to send requests to this endpoint could potentially inject arbitrary code. On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only present if the UI has been explicitly activated.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/golang-github-prometheus-alertmanager-dev | <0.23.0-4ubuntu0.2+esm1 | 0.23.0-4ubuntu0.2+esm1 |
| Ubuntu | =22.04 | |
| All of | ||
| ubuntu/prometheus-alertmanager | <0.23.0-4ubuntu0.2+esm1 | 0.23.0-4ubuntu0.2+esm1 |
| Ubuntu | =22.04 | |
| All of | ||
| ubuntu/golang-github-prometheus-alertmanager-dev | <0.15.3+ds-3ubuntu1.2 | 0.15.3+ds-3ubuntu1.2 |
| Ubuntu | =20.04 | |
| All of | ||
| ubuntu/prometheus-alertmanager | <0.15.3+ds-3ubuntu1.2 | 0.15.3+ds-3ubuntu1.2 |
| Ubuntu | =20.04 | |
| All of | ||
| ubuntu/golang-github-prometheus-alertmanager-dev | <0.6.2+ds-3ubuntu0.1+esm1 | 0.6.2+ds-3ubuntu0.1+esm1 |
| Ubuntu | =18.04 | |
| All of | ||
| ubuntu/prometheus-alertmanager | <0.6.2+ds-3ubuntu0.1+esm1 | 0.6.2+ds-3ubuntu0.1+esm1 |
| Ubuntu | =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of USN-6935-1?
The severity of USN-6935-1 is classified as high due to the potential for arbitrary code injection through an API endpoint.
How do I fix USN-6935-1?
To fix USN-6935-1, update the prometheus-alertmanager package to version 0.23.0-4ubuntu0.2+esm1 for Ubuntu 22.04 LTS or 0.15.3+ds-3ubuntu1.2 for Ubuntu 20.04 LTS.
Which versions of Ubuntu are affected by USN-6935-1?
USN-6935-1 affects Ubuntu 18.04 LTS, 20.04 LTS, and 22.04 LTS using specific versions of the prometheus-alertmanager package.
What is the nature of the vulnerability in USN-6935-1?
The vulnerability in USN-6935-1 stems from improper input sanitization in an API endpoint used by prometheus-alertmanager, allowing for potential code injection.
Is it necessary to reboot my system after applying the fix for USN-6935-1?
Typically, a reboot is not required after fixing USN-6935-1, but it is recommended to restart the prometheus-alertmanager service to ensure the changes take effect.
- agent/last-modified-date
- agent/title
- agent/references
- agent/severity
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/22.04
- version/ubuntu/20.04
- version/ubuntu/18.04