SUSE-SU-2025:01987-1: moderate: Security update for Multi-Linux Manager Client Tools

SLE-SECURITY-UPDATES null at suse.de
Wed Jun 18 08:30:57 UTC 2025 


# Security update for Multi-Linux Manager Client Tools

Announcement ID: SUSE-SU-2025:01987-1  
Release Date: 2025-06-18T02:09:14Z  
Rating: moderate  
References:

  * bsc#1208752
  * bsc#1231844
  * bsc#1233343
  * bsc#1236510
  * bsc#1236515
  * bsc#1236516
  * bsc#1238680
  * bsc#1238686
  * bsc#1238703
  * bsc#1241683
  * bsc#1241687
  * bsc#1241809
  * bsc#1243672
  * bsc#1243714
  * jsc#MSQA-992
  * jsc#PED-11740
  * jsc#PED-12872
  * jsc#PED-12918

  
Cross-References:

  * CVE-2023-45288
  * CVE-2024-9264
  * CVE-2024-9476
  * CVE-2025-22870
  * CVE-2025-22872
  * CVE-2025-2703
  * CVE-2025-29923
  * CVE-2025-3454

  
CVSS scores:

  * CVE-2023-45288 ( SUSE ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2023-45288 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2024-9264 ( SUSE ):  9.4
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-9264 ( SUSE ):  9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  * CVE-2024-9264 ( NVD ):  9.4
    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-9264 ( NVD ):  9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  * CVE-2024-9264 ( NVD ):  8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  * CVE-2024-9476 ( SUSE ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  * CVE-2024-9476 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2024-9476 ( NVD ):  0.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:N
  * CVE-2025-22870 ( SUSE ):  4.8
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2025-22870 ( SUSE ):  4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
  * CVE-2025-22870 ( NVD ):  4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
  * CVE-2025-22872 ( SUSE ):  6.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
  * CVE-2025-22872 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
  * CVE-2025-22872 ( NVD ):  6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
  * CVE-2025-2703 ( SUSE ):  6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
  * CVE-2025-2703 ( NVD ):  6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
  * CVE-2025-29923 ( SUSE ):  3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  * CVE-2025-29923 ( NVD ):  3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
  * CVE-2025-3454 ( SUSE ):  4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
  * CVE-2025-3454 ( NVD ):  5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

  
Affected Products:

  * SUSE Linux Enterprise Desktop 12
  * SUSE Linux Enterprise Desktop 12 SP1
  * SUSE Linux Enterprise Desktop 12 SP2
  * SUSE Linux Enterprise Desktop 12 SP3
  * SUSE Linux Enterprise Desktop 12 SP4
  * SUSE Linux Enterprise High Performance Computing 12 SP2
  * SUSE Linux Enterprise High Performance Computing 12 SP3
  * SUSE Linux Enterprise High Performance Computing 12 SP4
  * SUSE Linux Enterprise High Performance Computing 12 SP5
  * SUSE Linux Enterprise Server 12
  * SUSE Linux Enterprise Server 12 SP1
  * SUSE Linux Enterprise Server 12 SP2
  * SUSE Linux Enterprise Server 12 SP3
  * SUSE Linux Enterprise Server 12 SP4
  * SUSE Linux Enterprise Server 12 SP5
  * SUSE Linux Enterprise Server 12 SP5 LTSS
  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
  * SUSE Linux Enterprise Server for SAP Applications 12
  * SUSE Linux Enterprise Server for SAP Applications 12 SP1
  * SUSE Linux Enterprise Server for SAP Applications 12 SP2
  * SUSE Linux Enterprise Server for SAP Applications 12 SP3
  * SUSE Linux Enterprise Server for SAP Applications 12 SP4
  * SUSE Linux Enterprise Server for SAP Applications 12 SP5
  * SUSE Linux Enterprise Server for the Raspberry Pi 12-SP2
  * SUSE Manager Client Tools for SLE 12

  
  
An update that solves eight vulnerabilities, contains four features and has six
security fixes can now be installed.

## Description:

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

  * Security issues fixed:
  * CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
  * CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

  * Other bugs fixes from version 2.53.4:

  * Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml
    file resulting high cpu usage
  * Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0
(jsc#PED-12872):

  * Security issues fixed:
  * CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
  * CVE-2023-45288: Fixed closing connections when receiving too many headers
    (bsc#1236515)

  * Other changes from version 0.26.0:

  * Changes:
    * Replace go-kit/log with log/slog module.
  * Features:
    * Add metric to record tls ciphersuite negotiated during handshake.
    * Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
  * Enhancement:
    * Add stale workflow to start sync with stale.yaml in Prometheus.
  * Bug fixes:

    * Only register grpc TLS metrics on successful handshake.
  * Other changes from version 0.25.0:

  * Features:
    * Allow to get Probe logs by target.
    * Log errors from probe.
  * Bug fixes:
    * Prevent logging confusing error message.
    * Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

  * Security issues fixed:
  * CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  * CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  * CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  * CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  * CVE-2025-3454: Sanitize paths before evaluating access to route
    (bsc#1241683).
  * CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  * CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  * CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
  * CVE-2024-9264: SQL Expressions (bsc#1231844)
  * CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  * CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

  * Potential breaking changes in version 11.5.0:

  * Loki: Default to /labels API with query param instead of /series API.

  * Potential breaking changes in version 11.0.1:

  * If you had selected your language as "Português Brasileiro" previously,
    this will be reset. You have to select it again in your Preferences for the
    fix to be applied and the translations will then be shown.

  * Potential breaking changes in version 11.0.0:

  * AngularJS support is turned off by default.
  * Legacy alerting is entirely removed.
  * Subfolders cause very rare issues with folders which have slashes in their
    names.
  * The input data source is removed.
  * Data sources: Responses which are associated with hidden queries will be
    removed (filtered) by Grafana.
  * The URL which is generated when viewing an individual repeated panel has
    changed.
  * React Router is deprecated.
  * The grafana/e2e testing tool is deprecated.

  * This update brings many new features, enhancements and fixes highlighted at:

  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

golang-github-prometheus-node_exporter was updated to version 1.9.1:

  * Security issues fixed:
  * CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)

  * Other changes from version 1.9.1:

  * pressure: Fix missing IRQ on older kernels
  * Fix Darwin memory leak

golang-github-prometheus-alertmanager:

  * Security issues fixed:
  * CVE-2025-22870: Fix proxy bypassing using IPv6 zone IDs (bsc#1238686)
  * CVE-2023-45288: Fix HTTP/2 CONTINUATION flood in net/http (bsc#1236516)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Manager Client Tools for SLE 12  
    zypper in -t patch SUSE-SLE-Manager-Tools-12-2025-1987=1

  * SUSE Linux Enterprise Server 12 SP5 LTSS  
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2025-1987=1

  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security  
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2025-1987=1

## Package List:

  * SUSE Manager Client Tools for SLE 12 (aarch64 ppc64le s390x x86_64)
    * grafana-11.5.5-1.79.2
    * golang-github-prometheus-node_exporter-1.9.1-1.36.2
    * prometheus-blackbox_exporter-0.26.0-1.27.1
    * golang-github-prometheus-prometheus-2.53.4-1.60.2
    * golang-github-prometheus-alertmanager-0.26.0-1.31.2
    * prometheus-blackbox_exporter-debuginfo-0.26.0-1.27.1
  * SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
    * golang-github-prometheus-node_exporter-1.9.1-1.36.2
  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
    * golang-github-prometheus-node_exporter-1.9.1-1.36.2

## References:

  * https://www.suse.com/security/cve/CVE-2023-45288.html
  * https://www.suse.com/security/cve/CVE-2024-9264.html
  * https://www.suse.com/security/cve/CVE-2024-9476.html
  * https://www.suse.com/security/cve/CVE-2025-22870.html
  * https://www.suse.com/security/cve/CVE-2025-22872.html
  * https://www.suse.com/security/cve/CVE-2025-2703.html
  * https://www.suse.com/security/cve/CVE-2025-29923.html
  * https://www.suse.com/security/cve/CVE-2025-3454.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1208752
  * https://bugzilla.suse.com/show_bug.cgi?id=1231844
  * https://bugzilla.suse.com/show_bug.cgi?id=1233343
  * https://bugzilla.suse.com/show_bug.cgi?id=1236510
  * https://bugzilla.suse.com/show_bug.cgi?id=1236515
  * https://bugzilla.suse.com/show_bug.cgi?id=1236516
  * https://bugzilla.suse.com/show_bug.cgi?id=1238680
  * https://bugzilla.suse.com/show_bug.cgi?id=1238686
  * https://bugzilla.suse.com/show_bug.cgi?id=1238703
  * https://bugzilla.suse.com/show_bug.cgi?id=1241683
  * https://bugzilla.suse.com/show_bug.cgi?id=1241687
  * https://bugzilla.suse.com/show_bug.cgi?id=1241809
  * https://bugzilla.suse.com/show_bug.cgi?id=1243672
  * https://bugzilla.suse.com/show_bug.cgi?id=1243714
  * https://jira.suse.com/browse/MSQA-992
  * https://jira.suse.com/browse/PED-11740
  * https://jira.suse.com/browse/PED-12872
  * https://jira.suse.com/browse/PED-12918

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20250618/db1911f6/attachment.htm>

More information about the sle-security-updates mailing list