CVE-2022-21698

一、漏洞信息
漏洞编号：CVE-2022-21698
漏洞归属组件：alertmanager
漏洞归属的版本：0.21.0,0.26.0
CVSS V3.0分值：
BaseScore：7.5 High
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞简述：
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.
漏洞公开时间：2022-02-16 00:15:08
漏洞创建时间：2024-09-04 09:18:07
漏洞详情参考链接：
https://nvd.nist.gov/vuln/detail/CVE-2022-21698

更多参考(点击展开)

参考来源	参考链接	来源链接
security-advisories.github.com	https://github.com/prometheus/client_golang/pull/962
security-advisories.github.com	https://github.com/prometheus/client_golang/pull/987
security-advisories.github.com	https://github.com/prometheus/client_golang/releases/tag/v1.11.1
security-advisories.github.com	https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IK53GWZ475OQ6ENABKMJMTOBZG6LXUR/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L6GDN5S5QZSCFKWD3GKL2RDZQ6B4UWA/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5OGNAFVXSMTTT2UPH6CS3IH6L3KM42Q7/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V7I72LSQ3IET3QJR6QPAVGJZ4CBDLN5/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AK7CJBCGERCRXYUR2EWDSSDVAQMTAZGX/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FY3N7H6VSDZM37B4SKM2PFFCUWU7QYWN/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KBMVIQFKQDSSTHVVJWJ4QH6TW3JVB7XZ/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MH6ALXEQXIFQRQFNJ5Y2MJ5DFPIX76VN/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RN7JGC2LVHPEGSJYODFUV5FEKPBVG4D7/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SASRKYHT5ZFSVMJUQUG3UAEQRJYGJKAR/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKORFJTRRDJCWBTJPISKKCVMMMJBIRLG/
security-advisories.github.com	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/
suse_bugzilla	https://github.com/prometheus/client_golang/blob/22da9497b8f0d53072dfc4721904faa7395d8318/prometheus/promhttp/instrument_server.go#L95	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	https://bugzilla.redhat.com/show_bug.cgi?id=2045880	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21698	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	http://seclists.org/oss-sec/2022/q1/140	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	https://github.com/prometheus/client_golang/pull/962	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	https://github.com/prometheus/client_golang/releases/tag/v1.11.1	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p	https://bugzilla.suse.com/show_bug.cgi?id=1196338
suse_bugzilla	https://github.com/prometheus/client_golang/pull/987	https://bugzilla.suse.com/show_bug.cgi?id=1196338
redhat_bugzilla	https://github.com/prometheus/client_golang/blob/22da9497b8f0d53072dfc4721904faa7395d8318/prometheus/promhttp/instrument_server.go#L95	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://github.com/prometheus/client_golang/commit/989baa30fe956631907493ccee1f8e7708660d96	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:1461	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:1356	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/security/cve/cve-2022-21698	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:1762	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:2216	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:2218	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:2217	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:4667	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:4668	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:2280	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:5026	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:5068	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:5070	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:5069	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6042	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6040	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6061	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6066	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6051	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6156	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6290	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6430	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6526	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:6537	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:7261	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:7519	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:7529	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:8057	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:7399	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2022:9096	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2023:0566	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2023:0652	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2023:1158	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2023:2014	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2023:1326	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2023:5314	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2024:0564	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
redhat_bugzilla	https://access.redhat.com/errata/RHSA-2024:2944	https://bugzilla.redhat.com/show_bug.cgi?id=2045880
ubuntu	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21698	https://ubuntu.com/security/CVE-2022-21698
ubuntu	https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p	https://ubuntu.com/security/CVE-2022-21698
ubuntu	https://github.com/prometheus/client_golang/pull/962	https://ubuntu.com/security/CVE-2022-21698
ubuntu	https://github.com/prometheus/client_golang/pull/987	https://ubuntu.com/security/CVE-2022-21698
ubuntu	https://github.com/prometheus/client_golang/releases/tag/v1.11.1	https://ubuntu.com/security/CVE-2022-21698
ubuntu	https://nvd.nist.gov/vuln/detail/CVE-2022-21698	https://ubuntu.com/security/CVE-2022-21698
ubuntu	https://launchpad.net/bugs/cve/CVE-2022-21698	https://ubuntu.com/security/CVE-2022-21698
ubuntu	https://security-tracker.debian.org/tracker/CVE-2022-21698	https://ubuntu.com/security/CVE-2022-21698
debian		https://security-tracker.debian.org/tracker/CVE-2022-21698
oracle		https://www.oracle.com/security-alerts/linuxbulletinapr2022.html
anolis		https://anas.openanolis.cn/cves/detail/CVE-2022-21698
cve_search		https://github.com/prometheus/client_golang/pull/962
cve_search		https://github.com/prometheus/client_golang/releases/tag/v1.11.1
cve_search		https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p
cve_search		https://github.com/prometheus/client_golang/pull/987
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FY3N7H6VSDZM37B4SKM2PFFCUWU7QYWN/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKORFJTRRDJCWBTJPISKKCVMMMJBIRLG/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SASRKYHT5ZFSVMJUQUG3UAEQRJYGJKAR/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AK7CJBCGERCRXYUR2EWDSSDVAQMTAZGX/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KBMVIQFKQDSSTHVVJWJ4QH6TW3JVB7XZ/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V7I72LSQ3IET3QJR6QPAVGJZ4CBDLN5/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/
cve_search		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/

漏洞分析指导链接：
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息：

详情(点击展开)

影响的包	修复版本	修复补丁	问题引入补丁	来源
		https://github.com/prometheus/client_golang/pull/962		security-advisories.github.com
		https://github.com/prometheus/client_golang/pull/987		security-advisories.github.com
		https://github.com/prometheus/client_golang/pull/962		suse_bugzilla
		https://github.com/prometheus/client_golang/pull/987		suse_bugzilla
		https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7		redhat_bugzilla
		https://github.com/prometheus/client_golang/commit/989baa30fe956631907493ccee1f8e7708660d96		redhat_bugzilla
		https://github.com/prometheus/client_golang/pull/962		ubuntu
		https://github.com/prometheus/client_golang/pull/987		ubuntu
		https://github.com/prometheus/client_golang/pull/987		github_advisory
		https://github.com/prometheus/client_golang/pull/962		github_advisory
		https://github.com/prometheus/client_golang/pull/962		go
		https://github.com/prometheus/client_golang/pull/962		osv
		https://github.com/prometheus/client_golang/pull/987		osv
		https://github.com/open-telemetry/opentelemetry-go-contrib/commit/50ca48f8017e04bcf9149a5435e7f8f96f9e83c9		snyk
		https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277		snyk
		https://github.com/prometheus/client_golang/pull/962		nvd
		https://github.com/prometheus/client_golang/pull/987		nvd
		https://github.com/prometheus/client_golang/releases/tag/v1.11.1		nvd
		https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IK53GWZ475OQ6ENABKMJMTOBZG6LXUR/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2PFW6Q2LXXWTFRTMTRN4ZGADFRQPKJ3D/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36GUEPA5TPSC57DZTPYPBL6T7UPQ2FRH/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3L6GDN5S5QZSCFKWD3GKL2RDZQ6B4UWA/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4KDETHL5XCT6RZN2BBNOCEXRZ2W3SFU3/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5OGNAFVXSMTTT2UPH6CS3IH6L3KM42Q7/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7V7I72LSQ3IET3QJR6QPAVGJZ4CBDLN5/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AK7CJBCGERCRXYUR2EWDSSDVAQMTAZGX/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FY3N7H6VSDZM37B4SKM2PFFCUWU7QYWN/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HLAQRRGNSO5MYCPAXGPH2OCSHOGHSQMQ/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J5WPM42UR6XIBQNQPNQHM32X7S4LJTRX/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KBMVIQFKQDSSTHVVJWJ4QH6TW3JVB7XZ/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MH6ALXEQXIFQRQFNJ5Y2MJ5DFPIX76VN/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RN7JGC2LVHPEGSJYODFUV5FEKPBVG4D7/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SASRKYHT5ZFSVMJUQUG3UAEQRJYGJKAR/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKORFJTRRDJCWBTJPISKKCVMMMJBIRLG/		nvd
		https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/		nvd

二、漏洞分析结构反馈
影响性分析说明：

openEuler评分：
7.5
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
受影响版本排查(受影响/不受影响)：
1.master(0.26.0):
2.openEuler-20.03-LTS-SP4(0.21.0):
3.openEuler-22.03-LTS-SP1(0.21.0):
4.openEuler-22.03-LTS-SP3(0.21.0):
5.openEuler-22.03-LTS-SP4(0.21.0):
6.openEuler-24.03-LTS(0.26.0):
7.openEuler-24.03-LTS-Next(0.26.0):

修复是否涉及abi变化(是/否)：
1.master(0.26.0):
2.openEuler-20.03-LTS-SP4(0.21.0):
3.openEuler-22.03-LTS-SP1(0.21.0):
4.openEuler-22.03-LTS-SP3(0.21.0):
5.openEuler-22.03-LTS-SP4(0.21.0):
6.openEuler-24.03-LTS(0.26.0):
7.openEuler-24.03-LTS-Next(0.26.0):

原因说明：
1.master(0.26.0):
2.openEuler-20.03-LTS-SP4(0.21.0):
3.openEuler-22.03-LTS-SP1(0.21.0):
4.openEuler-22.03-LTS-SP3(0.21.0):
5.openEuler-22.03-LTS-SP4(0.21.0):
6.openEuler-24.03-LTS(0.26.0):
7.openEuler-24.03-LTS-Next(0.26.0):
8.openEuler-24.03-LTS-SP1:

@yangzhao_kl ,@jianminw ,@weibaohui ,@duguhaotian ,@jxy_git ,@wonleing ,@wubijie123 ,@gaodaweiky ,@zmr_2020 ,@lu-wei-army ,@xuxuepeng
issue处理注意事项:
1. 当前issue受影响的分支提交pr时, 须在pr描述中填写当前issue编号进行关联, 否则无法关闭当前issue;
2. 模板内容需要填写完整, 无论是受影响或者不受影响都需要填写完整内容,未引入的分支不需要填写, 否则无法关闭当前issue;
3. 以下为模板中需要填写完整的内容, 请复制到评论区回复, 注: 内容的标题名称(影响性分析说明, openEuler评分, 受影响版本排查(受影响/不受影响), 修复是否涉及abi变化(是/否))不能省略,省略后cve-manager将无法正常解析填写内容.

影响性分析说明:

openEuler评分: (评分和向量)

受影响版本排查(受影响/不受影响):
1.master(0.26.0):
2.openEuler-20.03-LTS-SP4(0.21.0):
3.openEuler-22.03-LTS-SP1(0.21.0):
4.openEuler-22.03-LTS-SP3(0.21.0):
5.openEuler-22.03-LTS-SP4(0.21.0):
6.openEuler-24.03-LTS(0.26.0):
7.openEuler-24.03-LTS-Next(0.26.0):

修复是否涉及abi变化(是/否)：
1.master(0.26.0):
2.openEuler-20.03-LTS-SP4(0.21.0):
3.openEuler-22.03-LTS-SP1(0.21.0):
4.openEuler-22.03-LTS-SP3(0.21.0):
5.openEuler-22.03-LTS-SP4(0.21.0):
6.openEuler-24.03-LTS(0.26.0):
7.openEuler-24.03-LTS-Next(0.26.0):

issue处理具体操作请参考:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
pr关联issue具体操作请参考:
https://gitee.com/help/articles/4142

参考网址	关联pr	状态	补丁链接
https://nvd.nist.gov/vuln/detail/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/987	closed	https://github.com/prometheus/client_golang/commit/a7b977b81965244b750baee57181a0d7ba41ccd0
https://nvd.nist.gov/vuln/detail/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/962	closed	https://github.com/prometheus/client_golang/commit/c74edb7a1609e17d87b573c94ee988c859f956e6 https://github.com/prometheus/client_golang/commit/db14f9724aa43da46b9045e6f1f4a416db298310 https://github.com/prometheus/client_golang/commit/18b6ddb319aac1848c0baffcd22597a33fed11d8 https://github.com/prometheus/client_golang/commit/0ef0275266e09a38f9659f39fce1ea9ce4ec8a92 https://github.com/prometheus/client_golang/commit/ff409ead375aaf97109396519fd01b5f347c36b5
https://ubuntu.com/security/CVE-2022-21698	None	None	https://discourse.ubuntu.com/c/ubuntu-pro
https://www.opencve.io/cve/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/987	closed	https://github.com/prometheus/client_golang/commit/a7b977b81965244b750baee57181a0d7ba41ccd0
https://www.opencve.io/cve/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/962	closed	https://github.com/prometheus/client_golang/commit/c74edb7a1609e17d87b573c94ee988c859f956e6 https://github.com/prometheus/client_golang/commit/db14f9724aa43da46b9045e6f1f4a416db298310 https://github.com/prometheus/client_golang/commit/18b6ddb319aac1848c0baffcd22597a33fed11d8 https://github.com/prometheus/client_golang/commit/0ef0275266e09a38f9659f39fce1ea9ce4ec8a92 https://github.com/prometheus/client_golang/commit/ff409ead375aaf97109396519fd01b5f347c36b5
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-21698	None	None	https://github.com/prometheus/client_golang/commit/989baa30fe956631907493ccee1f8e7708660d96 https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7
https://security-tracker.debian.org/tracker/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/987	closed	https://github.com/prometheus/client_golang/commit/a7b977b81965244b750baee57181a0d7ba41ccd0
https://security-tracker.debian.org/tracker/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/962	closed	https://github.com/prometheus/client_golang/commit/c74edb7a1609e17d87b573c94ee988c859f956e6 https://github.com/prometheus/client_golang/commit/db14f9724aa43da46b9045e6f1f4a416db298310 https://github.com/prometheus/client_golang/commit/18b6ddb319aac1848c0baffcd22597a33fed11d8 https://github.com/prometheus/client_golang/commit/0ef0275266e09a38f9659f39fce1ea9ce4ec8a92 https://github.com/prometheus/client_golang/commit/ff409ead375aaf97109396519fd01b5f347c36b5

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

参考网址	关联pr	状态	补丁链接
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-21698	None	None	https://github.com/prometheus/client_golang/commit/9075cdf61646b5adf54d3ba77a0e4f6c65cb4fd7 https://github.com/prometheus/client_golang/commit/989baa30fe956631907493ccee1f8e7708660d96
https://security-tracker.debian.org/tracker/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/962	closed	https://github.com/prometheus/client_golang/commit/c74edb7a1609e17d87b573c94ee988c859f956e6 https://github.com/prometheus/client_golang/commit/db14f9724aa43da46b9045e6f1f4a416db298310 https://github.com/prometheus/client_golang/commit/18b6ddb319aac1848c0baffcd22597a33fed11d8 https://github.com/prometheus/client_golang/commit/0ef0275266e09a38f9659f39fce1ea9ce4ec8a92 https://github.com/prometheus/client_golang/commit/ff409ead375aaf97109396519fd01b5f347c36b5
https://security-tracker.debian.org/tracker/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/987	closed	https://github.com/prometheus/client_golang/commit/a7b977b81965244b750baee57181a0d7ba41ccd0
https://www.opencve.io/cve/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/962	closed	https://github.com/prometheus/client_golang/commit/c74edb7a1609e17d87b573c94ee988c859f956e6 https://github.com/prometheus/client_golang/commit/db14f9724aa43da46b9045e6f1f4a416db298310 https://github.com/prometheus/client_golang/commit/18b6ddb319aac1848c0baffcd22597a33fed11d8 https://github.com/prometheus/client_golang/commit/0ef0275266e09a38f9659f39fce1ea9ce4ec8a92 https://github.com/prometheus/client_golang/commit/ff409ead375aaf97109396519fd01b5f347c36b5
https://www.opencve.io/cve/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/987	closed	https://github.com/prometheus/client_golang/commit/a7b977b81965244b750baee57181a0d7ba41ccd0
https://nvd.nist.gov/vuln/detail/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/962	closed	https://github.com/prometheus/client_golang/commit/c74edb7a1609e17d87b573c94ee988c859f956e6 https://github.com/prometheus/client_golang/commit/db14f9724aa43da46b9045e6f1f4a416db298310 https://github.com/prometheus/client_golang/commit/18b6ddb319aac1848c0baffcd22597a33fed11d8 https://github.com/prometheus/client_golang/commit/0ef0275266e09a38f9659f39fce1ea9ce4ec8a92 https://github.com/prometheus/client_golang/commit/ff409ead375aaf97109396519fd01b5f347c36b5
https://nvd.nist.gov/vuln/detail/CVE-2022-21698	https://github.com/prometheus/client_golang/pull/987	closed	https://github.com/prometheus/client_golang/commit/a7b977b81965244b750baee57181a0d7ba41ccd0

说明：补丁链接仅供初步排查参考，实际可用性请人工再次确认，补丁下载验证可使用CVE补丁工具。
若补丁不准确，烦请在此issue下评论 '/report-patch 参考网址补丁链接1,补丁链接2' 反馈正确信息，便于我们不断优化工具，不胜感激。
如 /report-patch https://security-tracker.debian.org/tracker/CVE-2021-3997 https://github.com/systemd/systemd/commit/5b1cf7a9be37e20133c0208005274ce4a5b5c6a1

影响性分析说明：更新 Prometheus 的 promhttp 中间件，增强了对 HTTP 方法的处理安全性和灵活性。它新增了 Option 配置支持，允许开发者自定义 HTTP 方法集合，对未知或未支持的方法统一归类为 unknown，从而避免潜在的安全漏洞。同时，对多处代码进行了优化，包括状态码和方法标签的校验、请求和响应的监控等。

openEuler评分：7.5
Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

受影响版本排查(受影响/不受影响)：
1.master(0.27.0): 不受影响
2.openEuler-20.03-LTS-SP4(0.21.0): 受影响
3.openEuler-22.03-LTS-SP1(0.21.0): 受影响
4.openEuler-22.03-LTS-SP3(0.21.0): 受影响
5.openEuler-22.03-LTS-SP4(0.21.0): 受影响
6.openEuler-24.03-LTS(0.26.0): 不受影响
7.openEuler-24.03-LTS-SP1(0.26.0): 不受影响
8.openEuler-24.03-LTS-Next(0.26.0): 不受影响

修复是否涉及abi变化(是/否)：
1.master(0.27.0): 否
2.openEuler-20.03-LTS-SP4(0.21.0): 否
3.openEuler-22.03-LTS-SP1(0.21.0): 否
4.openEuler-22.03-LTS-SP3(0.21.0): 否
5.openEuler-22.03-LTS-SP4(0.21.0): 否
6.openEuler-24.03-LTS(0.26.0): 否
7.openEuler-24.03-LTS-SP1(0.26.0): 否
8.openEuler-24.03-LTS-Next(0.26.0): 否

src-openEuler/alertmanager

内容风险标识

评论 (5)

src-openEuler/alertmanager .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-21698

评论 (5)

搜索帮助

src-openEuler/alertmanager