Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Exporter_toolkit | Prometheus | * | 0.7.2 (excluding) |
| Exporter_toolkit | Prometheus | 0.8.0 (including) | 0.8.2 (excluding) |
| Red Hat OpenShift Container Platform 4.11 | RedHat | openshift4/ose-thanos-rhel8:v4.11.0-202308311243.p0.g99b6e03.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.12 | RedHat | openshift4/ose-thanos-rhel8:v4.12.0-202305022015.p0.g9f2b5ff.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-kube-state-metrics:v4.13.0-202304190216.p0.g4b96984.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-prometheus:v4.13.0-202305020815.p0.g8279148.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-prometheus-alertmanager:v4.13.0-202304190216.p0.gf44d574.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-prometheus-node-exporter:v4.13.0-202304190216.p0.g10dc380.assembly.stream | * |
| Red Hat OpenShift Container Platform 4.13 | RedHat | openshift4/ose-thanos-rhel8:v4.13.0-202304190216.p0.gb6f11a5.assembly.stream | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | kinetic | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | lunar | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | trusty | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | upstream | * |
| Golang-github-prometheus-exporter-toolkit | Ubuntu | xenial | * |
| Prometheus | Ubuntu | bionic | * |
| Prometheus | Ubuntu | kinetic | * |
| Prometheus | Ubuntu | lunar | * |
| Prometheus | Ubuntu | mantic | * |
| Prometheus | Ubuntu | trusty | * |
| Prometheus | Ubuntu | xenial | * |