CVE-2022-46146: Improper Authentication
(updated )
Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users’ bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.
References
- www.openwall.com/lists/oss-security/2022/11/29/1
- www.openwall.com/lists/oss-security/2022/11/29/2
- www.openwall.com/lists/oss-security/2022/11/29/4
- github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5
- github.com/prometheus/exporter-toolkit/security/advisories/GHSA-7rg2-cxvp-9p7p
- nvd.nist.gov/vuln/detail/CVE-2022-46146
Code Behaviors & Features
Detect and mitigate CVE-2022-46146 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →