Arbitrary Code Injection Affecting golang-github-prometheus-node_exporter package, versions <1.3.0-150000.3.15.1


Severity

Recommended
0.0
medium
0
10

Based on SUSE Linux Enterprise Server security rating

    Threat Intelligence

    EPSS
    0.04% (14th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-SLES150-GOLANGGITHUBPROMETHEUSNODEEXPORTER-3019853
  • published 9 Sep 2022
  • disclosed 8 Sep 2022

How to fix?

Upgrade SLES:15.0 golang-github-prometheus-node_exporter to version 1.3.0-150000.3.15.1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream golang-github-prometheus-node_exporter package and not the golang-github-prometheus-node_exporter package as distributed by SLES. See How to fix? for SLES:15.0 relevant fixed versions and status.

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS Scores

version 3.1
Expand this section

NVD

7.1 high
  • Attack Vector (AV)
    Local
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    None
Expand this section

SUSE

6.6 medium
Expand this section

Red Hat

6.6 medium