[USN-6935-1] Prometheus Alertmanager vulnerability
[USN-6934-1] MySQL vulnerabilities
[USN-6935-1] Prometheus Alertmanager vulnerability
==========================================================================
Ubuntu Security Notice USN-6935-1
July 31, 2024
prometheus-alertmanager vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
Summary:
prometheus-alertmanager could be made to expose sensitive information over
the network.
Software Description:
- prometheus-alertmanager: handle and deliver alerts created by Prometheus
Details:
It was discovered that prometheus-alertmanager didn't properly sanitize
input it received through an API endpoint. An attacker with permission to
send requests to this endpoint could potentially inject arbitrary code.
On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, this vulnerability is only
present if the UI has been explicitly activated.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 22.04 LTS
golang-github-prometheus-alertmanager-dev 0.23.0-4ubuntu0.2+esm1
Available with Ubuntu Pro
prometheus-alertmanager 0.23.0-4ubuntu0.2+esm1
Available with Ubuntu Pro
Ubuntu 20.04 LTS
golang-github-prometheus-alertmanager-dev 0.15.3+ds-3ubuntu1.2
prometheus-alertmanager 0.15.3+ds-3ubuntu1.2
Ubuntu 18.04 LTS
golang-github-prometheus-alertmanager-dev 0.6.2+ds-3ubuntu0.1+esm1
Available with Ubuntu Pro
prometheus-alertmanager 0.6.2+ds-3ubuntu0.1+esm1
Available with Ubuntu Pro
On Ubuntu 20.04 LTS and Ubuntu 22.04 LTS, once the updates have been
installed, you need to recompile and reinstall the UI components and
restart the prometheus-alertmanager service afterwards.
On Ubuntu 18.04 LTS, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-6935-1
CVE-2023-40577
Package Information:
https://launchpad.net/ubuntu/+source/prometheus-alertmanager/0.15.3+ds-3ubuntu1.2
[USN-6934-1] MySQL vulnerabilities
==========================================================================
Ubuntu Security Notice USN-6934-1
July 31, 2024
mysql-8.0 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in MySQL.
Software Description:
- mysql-8.0: MySQL database
Details:
Multiple security issues were discovered in MySQL and this update includes
new upstream MySQL versions to fix these issues.
MySQL has been updated to 8.0.39 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,
and Ubuntu 24.04 LTS.
In addition to security fixes, the updated packages contain bug fixes, new
features, and possibly incompatible changes.
Please see the following for more information:
https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-38.html
https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-39.html
https://www.oracle.com/security-alerts/cpujul2024.html
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
mysql-server-8.0 8.0.39-0ubuntu0.24.04.1
Ubuntu 22.04 LTS
mysql-server-8.0 8.0.39-0ubuntu0.22.04.1
Ubuntu 20.04 LTS
mysql-server-8.0 8.0.39-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-6934-1
CVE-2024-20996, CVE-2024-21125, CVE-2024-21127, CVE-2024-21129,
CVE-2024-21130, CVE-2024-21134, CVE-2024-21142, CVE-2024-21162,
CVE-2024-21163, CVE-2024-21165, CVE-2024-21171, CVE-2024-21173,
CVE-2024-21177, CVE-2024-21179, CVE-2024-21185
Package Information:
https://launchpad.net/ubuntu/+source/mysql-8.0/8.0.39-0ubuntu0.24.04.1
https://launchpad.net/ubuntu/+source/mysql-8.0/8.0.39-0ubuntu0.22.04.1
https://launchpad.net/ubuntu/+source/mysql-8.0/8.0.39-0ubuntu0.20.04.1
