CVE-2021-29622
Fixed in a distro release EPSS 20%CVSS 6.5
Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus.
Products: prometheus
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/prometheus/prometheus | 2.26.1 |
| Go | github.com/prometheus/prometheus | 2.27.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | prometheus | 2.27.1-1 |
| SUSE Enterprise Storage 6 | golang-github-prometheus-prometheus | 2.27.1-3.8.1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.27.1-1.29.2 |
| SUSE Manager Client Tools 12 | grafana | 7.5.7-1.21.2 |
| SUSE Manager Client Tools 12 | mgr-cfg | 4.2.3-1.18.2 |
| SUSE Manager Client Tools 12 | mgr-custom-info | 4.2.2-1.12.2 |
| SUSE Manager Client Tools 12 | mgr-osad | 4.2.6-1.30.2 |
| SUSE Manager Client Tools 12 | mgr-push | 4.2.3-1.12.2 |
| SUSE Manager Client Tools 12 | mgr-virtualization | 4.2.2-1.20.2 |
| SUSE Manager Client Tools 12 | rhnlib | 4.2.4-21.34.2 |
| SUSE Manager Client Tools 12 | spacecmd | 4.2.11-38.85.2 |
| SUSE Manager Client Tools 12 | spacewalk-client-tools | 4.2.12-52.53.2 |
| SUSE Manager Client Tools 12 | spacewalk-koan | 4.2.4-24.24.2 |
| SUSE Manager Client Tools 12 | spacewalk-oscap | 4.2.2-19.18.2 |
| SUSE Manager Client Tools 12 | suseRegisterInfo | 4.2.4-25.18.2 |
| SUSE Manager Client Tools 12 | uyuni-common-libs | 4.2.5-1.15.2 |
| SUSE Manager Client Tools 15 | ansible | 2.9.21-1.5.1 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1627546504.96a0b3e-1.27.1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.27.1-3.31.1 |
| SUSE Manager Client Tools 15 | mgr-cfg | 4.2.3-1.18.1 |
| SUSE Manager Client Tools 15 | mgr-custom-info | 4.2.2-1.12.1 |
| SUSE Manager Client Tools 15 | mgr-osad | 4.2.6-1.30.1 |
| SUSE Manager Client Tools 15 | mgr-push | 4.2.3-1.12.1 |
| SUSE Manager Client Tools 15 | mgr-virtualization | 4.2.2-1.20.1 |
| SUSE Manager Client Tools 15 | rhnlib | 4.2.4-3.28.1 |
| SUSE Manager Client Tools 15 | spacecmd | 4.2.11-3.62.1 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.2.12-3.44.1 |
| SUSE Manager Client Tools 15 | spacewalk-koan | 4.2.4-3.21.1 |
| SUSE Manager Client Tools 15 | spacewalk-oscap | 4.2.2-3.12.1 |
| SUSE Manager Client Tools 15 | suseRegisterInfo | 4.2.4-3.15.1 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.2.5-1.15.1 |
| Ubuntu 16.04 LTS | prometheus | no fix |
| openSUSE Leap 15.2 | ansible | 2.9.21-lp152.2.7.1 |
| openSUSE Leap 15.2 | dracut-saltboot | 0.1.1627546504.96a0b3e-lp152.2.26.1 |
| openSUSE Leap 15.2 | golang-github-prometheus-prometheus | 2.27.1-lp152.3.13.1 |
| openSUSE Leap 15.3 | ansible | 2.9.21-1.5.1 |
| openSUSE Leap 15.3 | dracut-saltboot | 0.1.1627546504.96a0b3e-1.27.1 |
| openSUSE Leap 15.3 | golang-github-prometheus-prometheus | 2.27.1-3.8.1 |
| openSUSE Leap 15.3 | mgr-cfg | 4.2.3-1.18.1 |
| openSUSE Leap 15.3 | mgr-custom-info | 4.2.2-1.12.1 |
| openSUSE Leap 15.3 | mgr-osad | 4.2.6-1.30.1 |
| openSUSE Leap 15.3 | mgr-push | 4.2.3-1.12.1 |
| openSUSE Leap 15.3 | mgr-virtualization | 4.2.2-1.20.1 |
| openSUSE Leap 15.3 | rhnlib | 4.2.4-3.28.1 |
| openSUSE Leap 15.3 | spacecmd | 4.2.11-3.62.1 |
| openSUSE Leap 15.3 | spacewalk-client-tools | 4.2.12-3.44.1 |
| openSUSE Leap 15.3 | spacewalk-koan | 4.2.4-3.21.1 |
| openSUSE Leap 15.3 | spacewalk-oscap | 4.2.2-3.12.1 |
| openSUSE Leap 15.3 | suseRegisterInfo | 4.2.4-3.15.1 |
| openSUSE Leap 15.3 | uyuni-common-libs | 4.2.5-1.15.1 |
| openSUSE Tumbleweed | golang-github-prometheus-prometheus | 2.27.1-4.2 |