prometheus-alertmanager: CVE-2023-40577

Debian Bug report logs - #1050558
prometheus-alertmanager: CVE-2023-40577

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: prometheus-alertmanager: CVE-2023-40577

Date: Sat, 26 Aug 2023 11:47:11 +0200

Source: prometheus-alertmanager
Version: 0.25.0+ds-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for prometheus-alertmanager.

CVE-2023-40577[0]:
| Alertmanager handles alerts sent by client applications such as the
| Prometheus server. An attacker with the permission to perform POST
| requests on the /api/v1/alerts endpoint could be able to execute
| arbitrary JavaScript code on the users of Prometheus Alertmanager.
| This issue has been fixed in Alertmanager version 0.2.51.

Note the above seem to contian a typo in the dscription, should be
0.25.1.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-40577
    https://www.cve.org/CVERecord?id=CVE-2023-40577
[1] https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 1050558@bugs.debian.org (full text, mbox, reply):

From: Daniel Swarbrick <dswarbrick@debian.org>

To: 1050558@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>

Subject: prometheus-alertmanager: CVE-2023-40577

Date: Sat, 26 Aug 2023 13:34:03 +0200

[Message part 1 (text/plain, inline)]

Note that the Debian prometheus-alertmanager package strips out the web 
UI, so the fix in 0.25.1 would actually result in no changes to this 
package.

[OpenPGP_signature (application/pgp-signature, attachment)]

Message #17 received at 1050558@bugs.debian.org (full text, mbox, reply):

From: Daniel Swarbrick <dswarbrick@debian.org>

To: 1050558@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>

Subject: prometheus-alertmanager: CVE-2023-40577

Date: Sat, 26 Aug 2023 17:58:51 +0200

[Message part 1 (text/plain, inline)]

Disregard my previous comment - I was mistaken.

prometheus-alertmanager ships with a generate-ui.sh script which in the 
past fetched the Elm compiler from upstream (since it was not available 
in Debian), but the script has always used the Alertmanager web UI 
sources as shipped in the package.

[OpenPGP_signature (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.