{
  "cveId": "CVE-2023-3128",
  "url": "https://patchblox.com/security/cve/CVE-2023-3128",
  "summary": "CVE-2023-3128 is fixed in 6 products on 1 platform, first by ALSA-2023:4030, released July 12, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "golang-github-prometheus-promu: This update fixes the following issues:\n\ndracut-saltboot was updated to version 0.1.1728559936.c16d4fb:\n\n- Added MAC...",
  "description": "This update fixes the following issues:\n\ndracut-saltboot was updated to version 0.1.1728559936.c16d4fb:\n\n- Added MAC based terminal naming option (jsc#SUMA-314)\n\ngolang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):\n\n- Security issues fixed:\n  * CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error\n    handling (bsc#1232970)\n\n- Highlights of other changes:\n  * Performance: \n    \u002B Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and \n      remote write operations.\n    \u002B Default GOGC value lowered to 75 for better memory management. \n    \u002B Option to limit memory usage from dropped targets added.\n  * New Features:\n    \u002B Experimental OpenTelemetry ingestion.\n    \u002B Automatic memory limit handling.\n    \u002B Native histogram support, including new functions, UI enhancements, and improved scraping.\n    \u002B Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.\n    \u002B Expanded service discovery options with added metadata and support for new services.\n    \u002B New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.\n  * Bug Fixes: \n    \u002B Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.\n  * For a detailed list of changes consult the package changelog or \n    https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3\n\ngrafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):\n\n- Security issues fixed:\n  * CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading \n    golang.org/x/crypto (bsc#1234554)\n  * CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n  * CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)\n  * CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)\n\n- Potential breaking changes in version 10:\n  * In panels using the \u0060extract fields\u0060 transformation, where one\n    of the extracted names collides with one of the already\n    existing ields, the extracted field will be renamed.\n  * For the existing backend mode users who have table\n    visualization might see some inconsistencies on their panels.\n    We have updated the table column naming. This will\n    potentially affect field transformations and/or field\n    overrides. To resolve this either: update transformation or\n    field override.\n  * For the existing backend mode users who have Transformations\n    with the \u0060time\u0060 field, might see their transformations are\n    not working. Those panels that have broken transformations\n    will fail to render. This is because we changed the field\n    key. To resolve this either: Remove the affected panel and\n    re-create it; Select the \u0060Time\u0060 field again; Edit the \u0060time\u0060\n    field as \u0060Time\u0060 for transformation in \u0060panel.json\u0060 or\n    \u0060dashboard.json\u0060 \n  * The following data source permission endpoints have been removed:\n    \u0060GET /datasources/:datasourceId/permissions\u0060\n    \u0060POST /api/datasources/:datasourceId/permissions\u0060\n    \u0060DELETE /datasources/:datasourceId/permissions\u0060\n    \u0060POST /datasources/:datasourceId/enable-permissions\u0060\n    \u0060POST /datasources/:datasourceId/disable-permissions\u0060\n    \u002B Please use the following endpoints instead:\n      \u0060GET /api/access-control/datasources/:uid\u0060 for listing data\n       source permissions\n      \u0060POST /api/access-control/datasources/:uid/users/:id\u0060,\n      \u0060POST /api/access-control/datasources/:uid/teams/:id\u0060 and\n      \u0060POST /api/access-control/datasources/:uid/buildInRoles/:id\u0060 \n      for adding or removing data source permissions\n  * If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your\n    provider.\n  * For the existing backend mode users who have table visualization might see some inconsistencies on their panels. \n    We have updated the table column naming. This will potentially affect field transformations and/or field overrides.\n  * The deprecated \u0060/playlists/{uid}/dashboards\u0060 API endpoint has been removed. \n    Dashboard information can be retrieved from the \u0060/dashboard/...\u0060 APIs.\n  * The \u0060PUT /api/folders/:uid\u0060 endpoint no more supports modifying the folder\u0027s \u0060UID\u0060\n  * Removed all components for the old panel header design.\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/\n    for more details\n  * OAuth role mapping enforcement: This change impacts GitHub,\n    Gitlab, Okta, and Generic OAuth. To avoid overriding manually\n    set roles, enable the skip_org_role_sync option in the\n    Grafana configuration for your OAuth provider before\n    upgrading\n  * Angular has been deprecated\n  * Grafana legacy alerting has been deprecated\n  * API keys are migrating to service accounts\n  * The experimental \u201Cdashboard previews\u201D feature is removed\n  * Usernames are now case-insensitive by default\n  * Grafana OAuth integrations do not work anymore with email lookups\n  * The \u201CAlias\u201D field in the CloudWatch data source is removed\n  * Athena data source plugin must be updated to version \u003E=2.9.3\n  * Redshift data source plugin must be updated to version \u003E=1.8.3\n  * DoiT International BigQuery plugin no longer supported\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0\n    for more details\n\n- This update brings many new features, enhancements and fixes highlighted at:\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/:\n\nspacecmd was updated to version 5.0.11-0:\n\n- Updated translation strings\n\nsupportutils-plugin-salt was updated to version 1.2.3:\n\n- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)\n- Provide backwards-compatible scripts version\n\nsupportutils-plugin-susemanager-client was updated to version 5.0.4-0:\n\n- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)\n\nuyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:\n\n- Security issues fixed:\n  * CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)\n- Other changes and bugs fixed:\n  * Version 0.1.27-0\n    \u002B Bump the default image tag to 5.0.3\n    \u002B IsInstalled function fix\n    \u002B Run systemctl daemon-reload after changing the container image config (bsc#1233279)\n    \u002B Coco-replicas-upgrade\n    \u002B Persist search server indexes (bsc#1231759)\n    \u002B Sync deletes files during migration (bsc#1233660)\n    \u002B Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)\n    \u002B Add --registry back to mgrpxy (bsc#1233202)\n    \u002B Only add java.hostname on migrated server if not present\n    \u002B Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)\n    \u002B Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)\n    \u002B Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)\n  * Version 0.1.26-0\n    \u002B Ignore all zypper caches during migration (bsc#1232769)\n    \u002B Use the uyuni network for all podman containers (bsc#1232817)\n  * Version 0.1.25-0\n    \u002B Don\u0027t migrate enabled systemd services, recreate them (bsc#1232575)\n  * Version 0.1.24-0\n    \u002B Redact JSESSIONID and pxt-session-cookie values from logs and\n      console output (bsc#1231568)",
  "published": "2023-07-12T00:00:00Z",
  "severity": "Moderate",
  "cvss": 9.8,
  "epss": 0.03995,
  "epssPercentile": 0.90581,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "dracut-saltboot",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.1.1728559936.c16d4fb-150000.1.56.1",
      "fix": "SUSE-SU-2025:0525-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1",
      "released": "2025-02-14T07:18:27Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-prometheus-promu",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "0.17.0-150000.3.24.1",
      "fix": "SUSE-SU-2025:0525-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1",
      "released": "2025-02-14T07:18:27Z"
    },
    {
      "platform": "linux",
      "product": "golang-github-prometheus-promu",
      "release": "sles 15.6",
      "fixedVersion": "0.17.0-150000.3.24.1",
      "fix": "SUSE-SU-2025:0525-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1",
      "released": "2025-02-14T07:18:27Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "RHEL 8",
      "fixedVersion": "0:9.2.10-7.el8_9",
      "fix": "RHSA-2023:6972",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2023-6972",
      "released": "2023-11-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "RHEL 9",
      "fixedVersion": "0:9.2.10-7.el9_3",
      "fix": "RHSA-2023:6420",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2023-6420",
      "released": "2023-11-07T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "almalinux 8",
      "fixedVersion": "9.2.10-7.el8_9.alma.1",
      "fix": "ALSA-2023:6972",
      "url": "https://patchblox.com/security/fix/linux/alsa-2023-6972",
      "released": "2023-11-14T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "almalinux 9",
      "fixedVersion": "9.0.9-3.el9_2.alma",
      "fix": "ALSA-2023:4030",
      "url": "https://patchblox.com/security/fix/linux/alsa-2023-4030",
      "released": "2023-07-12T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "ol 8",
      "fixedVersion": "0:9.2.10-7.el8_9",
      "fix": "ELSA-2023-6972",
      "url": "https://patchblox.com/security/fix/linux/elsa-2023-6972",
      "released": "2023-11-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "ol 9",
      "fixedVersion": "0:9.0.9-3.el9_2",
      "fix": "ELSA-2023-4030",
      "url": "https://patchblox.com/security/fix/linux/elsa-2023-4030",
      "released": "2023-07-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "10.4.13-150200.3.59.1",
      "fix": "SUSE-SU-2025:0545-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0545-1",
      "released": "2025-02-14T07:24:15Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "rocky 9",
      "fixedVersion": "0:9.0.9-3.el9_2",
      "fix": "RLSA-2023:4030",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2023-4030",
      "released": "2023-07-19T17:53:40Z"
    },
    {
      "platform": "linux",
      "product": "grafana",
      "release": "sles 15.6",
      "fixedVersion": "10.4.13-150200.3.59.1",
      "fix": "SUSE-SU-2025:0545-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0545-1",
      "released": "2025-02-14T07:24:15Z"
    },
    {
      "platform": "linux",
      "product": "spacecmd",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "5.0.11-150000.3.130.1",
      "fix": "SUSE-SU-2025:0525-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1",
      "released": "2025-02-14T07:18:27Z"
    },
    {
      "platform": "linux",
      "product": "supportutils-plugin-salt",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.2.3-150000.3.16.1",
      "fix": "SUSE-SU-2025:0525-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1",
      "released": "2025-02-14T07:18:27Z"
    },
    {
      "platform": "linux",
      "product": "supportutils-plugin-salt",
      "release": "sles 15.6",
      "fixedVersion": "1.2.3-150000.3.16.1",
      "fix": "SUSE-SU-2025:0525-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1",
      "released": "2025-02-14T07:18:27Z"
    },
    {
      "platform": "linux",
      "product": "supportutils-plugin-susemanager-client",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "5.0.4-150000.3.27.1",
      "fix": "SUSE-SU-2025:0525-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-0525-1",
      "released": "2025-02-14T07:18:27Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}