1. Ubuntu Security Notices
  2. USN-6935-1

USN-6935-1: Prometheus Alertmanager vulnerability

Publication date

31 July 2024

Overview

prometheus-alertmanager could be made to expose sensitive information over the network.

Releases

Packages

Details

It was discovered that prometheus-alertmanager didn’t properly sanitize
input it received through an API endpoint. An attacker with permission to
send requests to this endpoint could potentially inject arbitrary code.

On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only
present if the UI has been explicitly activated.

It was discovered that prometheus-alertmanager didn’t properly sanitize
input it received through an API endpoint. An attacker with permission to
send requests to this endpoint could potentially inject arbitrary code.

On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only
present if the UI has been explicitly activated.

Update instructions

On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, once the updates have been installed, you need to recompile and reinstall the UI components and restart the prometheus-alertmanager service afterwards. On Ubuntu 18.04 LTS, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
22.04 jammy golang-github-prometheus-alertmanager-dev –  0.23.0-4ubuntu0.2+esm1  
prometheus-alertmanager –  0.23.0-4ubuntu0.2+esm1  
20.04 focal golang-github-prometheus-alertmanager-dev –  0.15.3+ds-3ubuntu1.2
prometheus-alertmanager –  0.15.3+ds-3ubuntu1.2
18.04 bionic golang-github-prometheus-alertmanager-dev –  0.6.2+ds-3ubuntu0.1+esm1  
prometheus-alertmanager –  0.6.2+ds-3ubuntu0.1+esm1  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›