Arbitrary Code Injection Affecting golang-github-prometheus-node_exporter package, versions <1.3.0-150000.3.15.1
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-SLES150-GOLANGGITHUBPROMETHEUSNODEEXPORTER-3019853
- published 9 Sep 2022
- disclosed 8 Sep 2022
How to fix?
Upgrade SLES:15.0 golang-github-prometheus-node_exporter to version 1.3.0-150000.3.15.1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream golang-github-prometheus-node_exporter package and not the golang-github-prometheus-node_exporter package as distributed by SLES.
See How to fix? for SLES:15.0 relevant fixed versions and status.
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.