Bugzilla – Bug 1212219
VUL-0: CVE-2023-24535: golang-github-prometheus-prometheus: google.golang.org/protobuf: panic leading to denial of service
Last modified: 2023-09-24 06:29:11 UTC
+++ This bug was initially created as a clone of Bug #1212218 +++ CVE-2023-24535 Parsing invalid messages can panic. Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-24535 https://www.cve.org/CVERecord?id=CVE-2023-24535 https://github.com/golang/protobuf/issues/1530 https://go.dev/cl/475995 https://pkg.go.dev/vuln/GO-2023-1631
openSUSE:Factory/golang-github-prometheus-prometheus embeds a vulnerable version of the google.golang.org/protobuf module.
As far as I can tell, this is already fixed in Tumbleweed: v2.43.0 contained the 1.29.0 version of google.golang.org/protobuf https://github.com/prometheus/prometheus/blob/v2.43.0/go.mod#L73 v2.44.0 and later contain the 1.30.0 version (or later): https://github.com/prometheus/prometheus/blob/v2.44.0/go.mod#L73 https://github.com/prometheus/prometheus/blob/v2.45.0/go.mod#L75 https://github.com/prometheus/prometheus/blob/v2.46.0/go.mod#L76 https://github.com/prometheus/prometheus/blob/v2.47.0/go.mod#L79 v2.44.0 hit Factory in SR#1087896 on 21st of May https://build.opensuse.org/request/show/1087896
Adding Witek for awareness.