Update module github.com/prometheus/alertmanager to v0.25.1 [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/prometheus/alertmanager	v0.22.2 → v0.25.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

BIT-alertmanager-2023-40577 / CVE-2023-40577 / GHSA-v86x-5fm3-5p7j / GO-2023-2020

More information

Details

Impact

An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.

Patches

Users can upgrade to Alertmanager v0.2.51.

Workarounds

Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.

References

N/A

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j
• https://nvd.nist.gov/vuln/detail/CVE-2023-40577
• https://github.com/prometheus/alertmanager
• https://lists.debian.org/debian-lts-announce/2023/10/msg00011.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager

BIT-alertmanager-2023-40577 / CVE-2023-40577 / GHSA-v86x-5fm3-5p7j / GO-2023-2020

More information

Details

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint in github.com/prometheus/alertmanager

Severity

Unknown

References

• https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j
• https://nvd.nist.gov/vuln/detail/CVE-2023-40577
• https://lists.debian.org/debian-lts-announce/2023/10/msg00011.html

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

Release Notes

prometheus/alertmanager (github.com/prometheus/alertmanager)

v0.25.1: 0.25.1 / 2023-08-23

Compare Source

• [SECURITY] Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (CVE-2023-40577).

v0.25.0: 0.25.0 / 2022-12-22

Compare Source

• [CHANGE] Change the default parse_mode value from MarkdownV2 to HTML for Telegram. #​2981
• [CHANGE] Make api_url field optional for Telegram. #​2981
• [CHANGE] Use CanonicalMIMEHeaderKey instead of TitleCasing for email headers. #​3080
• [CHANGE] Reduce the number of notification logs broadcasted between peers by expiring them after (2 * repeat interval). #​2982
• [FEATURE] Add proxy_url support for OAuth2 in HTTP client configuration. #​3010
• [FEATURE] Reload TLS certificate and key from disk when updated. #​3168
• [FEATURE] Add Discord integration. #​2948
• [FEATURE] Add Webex integration. #​3132
• [ENHANCEMENT] Add --web.systemd-socket flag to systemd socket activation listeners instead of port listeners (Linux only). #​3140
• [ENHANCEMENT] Add enable_http2 support in HTTP client configuration. #​3010
• [ENHANCEMENT] Add min_version support to select the minimum TLS version in HTTP client configuration. #​3010
• [ENHANCEMENT] Add max_version support to select the maximum TLS version in HTTP client configuration. #​3168
• [ENHANCEMENT] Emit warning logs when truncating messages in notifications. #​3145
• [ENHANCEMENT] Add --data.maintenance-interval flag to define the interval between the garbage collection and snapshotting to disk of the silences and the notification logs. #​2849
• [ENHANCEMENT] Support HEAD method for the /-/healty and /-/ready endpoints. #​3039
• [ENHANCEMENT] Truncate messages with the … ellipsis character instead of the 3-dots string .... #​3072
• [ENHANCEMENT] Add support for reading global and local SMTP passwords from files. #​3038
• [ENHANCEMENT] Add Location support to time intervals. #​2782
• [ENHANCEMENT] UI: Add 'Link' button to alerts in list. #​2880
• [ENHANCEMENT] Add the source field to the PagerDuty configuration. #​3106
• [ENHANCEMENT] Add support for reading PagerDuty routing and service keys from files. #​3107
• [ENHANCEMENT] Log response details when notifications fail for Webhooks, Pushover and VictorOps. #​3103
• [ENHANCEMENT] UI: Allow to choose the first day of the week as Sunday or Monday. #​3093
• [ENHANCEMENT] Add support for reading VictorOps API key from file. #​3111
• [ENHANCEMENT] Support templating for Opsgenie's responder type. #​3060
• [BUGFIX] Fail configuration loading if api_key and api_key_file are defined at the same time. #​2910
• [BUGFIX] Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior. #​2943
• [BUGFIX] Trim contents of Slack API URLs when reading from files. #​2929
• [BUGFIX] amtool: Avoid panic when the label value matcher is empty. #​2968
• [BUGFIX] Fail configuration loading if api_url is empty for OpsGenie. #​2910
• [BUGFIX] Fix email template for resolved notifications. #​3166
• [BUGFIX] Use the HTML template engine when the parse mode is HTML for Telegram. #​3183

v0.24.0: 0.24.0 / 2022-03-24

Compare Source

• [CHANGE] Add the /api/v2 prefix to all endpoints in the OpenAPI specification and generated client code. #​2696
• [CHANGE] Remove the github.com/prometheus/alertmanager/client Go package. #​2763
• [FEATURE] Add --cluster.tls-config experimental flag to secure cluster traffic via mutual TLS. #​2237
• [FEATURE] Add support for active time intervals. Active and mute time intervals should be defined via time_intervals rather than mute_time_intervals (the latter is deprecated but it will be supported until v1.0). #​2779
• [FEATURE] Add Telegram integration. #​2827
• [ENHANCEMENT] Add update_alerts field to the OpsGenie configuration to update message and description when sending alerts. #​2519
• [ENHANCEMENT] Add --cluster.allow-insecure-public-advertise-address-discovery feature flag to enable discovery and use of public IP addresses for clustering. #​2719
• [ENHANCEMENT] Add entity and actions fields to the OpsGenie configuration. #​2753
• [ENHANCEMENT] Add opsgenie_api_key_file field to the global configuration. #​2728
• [ENHANCEMENT] Add support for teams responders to the OpsGenie configuration. #​2685
• [ENHANCEMENT] Add the User-Agent header to all notification requests. #​2730
• [ENHANCEMENT] Re-enable HTTP/2. #​2720
• [ENHANCEMENT] web: Add support for security-related HTTP headers. #​2759
• [ENHANCEMENT] amtool: Allow filtering of silences by createdBy author. #​2718
• [ENHANCEMENT] amtool: add --http.config.file flag to configure HTTP settings. #​2764
• [BUGFIX] Fix HTTP client configuration for the SNS receiver. #​2706
• [BUGFIX] Fix unclosed file descriptor after reading the silences snapshot file. #​2710
• [BUGFIX] Fix field names for mute_time_intervals in JSON marshaling. #​2765
• [BUGFIX] Ensure that the root route doesn't have any matchers. #​2780
• [BUGFIX] Truncate the message's title to 1024 chars to avoid hitting Slack limits. #​2774
• [BUGFIX] Fix the default HTML email template (email.default.html) to match with the canonical source. #​2798
• [BUGFIX] Detect SNS FIFO topic based on the rendered value. #​2819
• [BUGFIX] Avoid deleting and recreating a silence when an update is possible. #​2816
• [BUGFIX] api/v2: Return 200 OK when deleting an expired silence. #​2817
• [BUGFIX] amtool: Fix the silence's end date when adding a silence. The end date is (start date + duration) while it used to be (current time + duration). The new behavior is consistent with the update operation. #​2741

v0.23.0: 0.23.0 / 2021-08-25

Compare Source

• [FEATURE] Add AWS SNS receiver. #​2615
• [FEATURE] amtool: add new template render command. #​2538
• [ENHANCEMENT] amtool: Add ability to skip TLS verification for amtool. #​2663
• [ENHANCEMENT] amtool: Detect version drift and warn users. #​2672
• [BUGFIX] Time-based muting: Ensure time interval comparisons are in UTC. #​2648
• [BUGFIX] amtool: Fix empty isEqual when talking to incompatible alertmanager. #​2668

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 25 additional dependencies were updated

Details:

Package	Change
github.com/alecthomas/units	v0.0.0-20210208195552-ff826a37aa15 -> v0.0.0-20211218093645-b94a6e3cc137
github.com/aws/aws-sdk-go	v1.38.60 -> v1.44.156
github.com/cespare/xxhash/v2	v2.1.1 -> v2.2.0
github.com/envoyproxy/go-control-plane	v0.9.9-0.20210217033140-668b12f5399d -> v0.10.2-0.20220325020618-49ff273808a1
github.com/go-kit/log	v0.1.0 -> v0.2.1
github.com/go-logfmt/logfmt	v0.5.0 -> v0.5.1
github.com/go-openapi/strfmt	v0.20.1 -> v0.21.3
github.com/google/pprof	v0.0.0-20210609004039-a478d1d731e9 -> v0.0.0-20210720184732-4bb14d4b1be1
github.com/hashicorp/consul/api	v1.8.1 -> v1.12.0
github.com/json-iterator/go	v1.1.11 -> v1.1.12
github.com/prometheus/client_golang	v1.11.0 -> v1.14.0
github.com/prometheus/client_model	v0.2.0 -> v0.3.0
github.com/prometheus/common	v0.29.0 -> v0.38.0
github.com/prometheus/exporter-toolkit	v0.6.1 -> v0.8.2
github.com/stretchr/testify	v1.7.0 -> v1.8.1
go.uber.org/atomic	v1.8.0 -> v1.10.0
golang.org/x/net	v0.0.0-20210610132358-84b48f89b13b -> v0.4.0
golang.org/x/oauth2	v0.0.0-20210514164344-f6687ab2804c -> v0.0.0-20220909003341-f21342109be1
golang.org/x/sync	v0.0.0-20210220032951-036812b2e83c -> v0.1.0
golang.org/x/sys	v0.0.0-20210615035016-665e8c7367d1 -> v0.3.0
golang.org/x/tools	v0.1.3 -> v0.4.0
google.golang.org/api	v0.48.0 -> v0.84.0
google.golang.org/genproto	v0.0.0-20210604141403-392c879c8b08 -> v0.0.0-20220616135557-88e70c0c3a90
google.golang.org/protobuf	v1.26.0 -> v1.28.1
gopkg.in/yaml.v3	v3.0.0-20210107192922-496545a6307b -> v3.0.1

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: red-hat-konflux[bot]

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment