Go/github.com/prometheus/prometheus: high 7.2
Prometheus vulnerable to basic authentication bypass
Action: Upgrade github.com/prometheus/prometheus to 2.37.4 or later.
go get github.com/prometheus/prometheus@v2.37.4go get github.com/prometheus/prometheus@v2.40.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.24.1 | 2.37.4 | - |
| 2.38.0 | 2.40.4 | - |
Fixed versions
| 2.37.4 | 2.40.4 |
Sources
- osv: GHSA-4v48-4q5m-8vx4
- https://github.com/prometheus/prometheus/security/advisories/GHSA-4v48-4q5m-8vx4
- https://github.com/prometheus/prometheus/commit/31a2db3ae9c0f4b486b6895973beabc1d1beac93
- https://github.com/prometheus/prometheus/releases/tag/v2.37.4
- https://github.com/prometheus/prometheus/releases/tag/v2.40.4
published · modified · JSON