From nobody Sat Feb 04 19:11:52 2023 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4P8MZw4rKNz3nl9G; Sat, 4 Feb 2023 19:11:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4P8MZw4Ptwz3Jc8; Sat, 4 Feb 2023 19:11:52 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1675537912; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0ijW0m0JssIW+J/j7xyYfp5lPGdTclXzViweizfDMEo=; b=aC+LyNxl4bYdF1J/5HJfkgxpArVz97v46vgPF74Yw7Lrcz01dTr7atUlLEgEXD4OfiSEQy mEpFY4QmaW12jBFxuW/I3JjmxMLZ4qLpabQkCj7xnbWO7U3nDDxAqQ3v7qYqSTRWrMWp64 rpD2f6ZORfOEOCIc38gXG6Tv3Vhdtg/e/RfCyU39Z1uUV+Bkb17HsuP61N9l9DrX7TrOZL DQxnMtstYh6IHH6KjgT7inq9hEwFVGtGYLzKvrRyQQLlOeY5opNQXfWZLsareDhJMMYi3+ ANstE6OxcGuwM85WUD+OV/I9d1660umRL/yGxTVQ32/ixw3VfQaZ2DBt9mesHg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1675537912; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=0ijW0m0JssIW+J/j7xyYfp5lPGdTclXzViweizfDMEo=; b=w02Ei1wO6n0Vozt5gvdMEnaKe5LbfGUjL7+AlYa7EgULz0Ze5Jm3wyn6y3MyUpYy0k4rI1 3ldaaUKLqiuEzXaCPteceRUtBRxyGGXjTg6c+hj8gNuARa4S+UEBW0RNaqiAY/qbPd5aKx JJ3QYiiEt/mGXpZfefxHIsSkBHNBH85Of/ORxJZ1QSvh0kxeVWpTSdXxmFwl6sbXA4ogwb /6cXXrZF5lmidvtalStxyIouRlCV7wUHc9sKYAbB6npodyD5N67d/LW4+ZqV6wey8mKaHa jaIL4ofAClc2vmxguOdNzQ7ZZ07jWOgy2t+GedIVOgknMUTWiYB5cvFPmdjhcA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1675537912; a=rsa-sha256; cv=none; b=XQNlZkUE+8KxqZlmvC+oE/NpZzoZFnuCwbk377K1lliPK3Mefl/SxjrLJJpK1Lavx+NSN4 7wjhnRDMqcpDCdkjBJL/alDbnsbFxes9V/jXnXGP/GLX9vbGR18vZm/4mReuKtYB9J4mU4 CtWycb7B6G7vTvfnrfDMLx2WZx/owF+Vvsp+GcYRFks0JGhFHZgq2ZTX5i4XaD+GaXivW0 RH37rc7/4A518nL30p3Qmd8rtx4oNDRo7PQyyMVlQ+x5CCQIkGm1arpHAMLIgoPlEWXI1D r7xbeHoSvRpZIxbYxUu8lZdCouQAXDMkfTaRBvjA28xRQVGiWHYn5o2HFnX8wQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4P8MZw3Tn5zR4m; Sat, 4 Feb 2023 19:11:52 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 314JBq9E061340; Sat, 4 Feb 2023 19:11:52 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 314JBqIg061339; Sat, 4 Feb 2023 19:11:52 GMT (envelope-from git) Date: Sat, 4 Feb 2023 19:11:52 GMT Message-Id: <202302041911.314JBqIg061339@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: =?utf-8?Q?Fernando=20Apestegu=C3=ADa?= Subject: git: 5544ae86f3ff - main - security/vuxml: Register sysutils/node_exporter vulnerability List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: fernape X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5544ae86f3ff0b781f29b81283c0543a3b7581be Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by fernape: URL: https://cgit.FreeBSD.org/ports/commit/?id=5544ae86f3ff0b781f29b81283c0543a3b7581be commit 5544ae86f3ff0b781f29b81283c0543a3b7581be Author: Fernando Apesteguía AuthorDate: 2023-02-04 19:04:32 +0000 Commit: Fernando Apesteguía CommitDate: 2023-02-04 19:04:32 +0000 security/vuxml: Register sysutils/node_exporter vulnerability CVE-2022-46146 Note that in https://cgit.freebsd.org/ports/commit/?id=8b5d2b9a9ec7985158a814e2cdf9022d785b9090 three CVEs are mentioned: CVE-2022-27191 CVE-2022-27664 CVE-2022-46146 However, according to: https://github.com/prometheus/node_exporter/pull/2488 node_exported is not really affected by those Go vulnerabilities. However the dependencies were bumped anyway. --- security/vuxml/vuln/2023.xml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 8175d88e27b4..807eceae5259 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,44 @@ + + node_exporter -- bypass security with cache poisoning + + + node_exporter + 1.5.0 + + + + +

Prometheus team reports:

+
+

+ Prometheus and its exporters can be secured by a web.yml file that + specifies usernames and hashed passwords for basic authentication. + Passwords are hashed with bcrypt, which means that even if you have + access to the hash, it is very hard to find the original password + back. Passwords are hashed with bcrypt, which means that even if you + have access to the hash, it is very hard to find the original + password back. However, a flaw in the way this mechanism was + implemented in the exporter toolkit makes it possible with people + who know the hashed password to authenticate against Prometheus. + A request can be forged by an attacker to poison the internal cache + used to cache the computation of hashes and make subsequent requests + successful. This cache is used in both happy and unhappy scenarios + in order to limit side channel attacks that could tell an attacker + if a user is present in the file or not. +

+
+ + + + CVE-2022-46146 + https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46146 + + + 2021-11-28 + 2023-02-04 + + + Asterisk -- multiple vulnerabilities