File _patchinfo of Package patchinfo.43017

<patchinfo incident="43017">
  <issue tracker="ijsc" id="MSQA-1045"/>
  <issue tracker="cve" id="2026-25547"/>
  <issue tracker="cve" id="2025-12816"/>
  <issue tracker="cve" id="2025-13465"/>
  <issue tracker="cve" id="2026-1615"/>
  <issue tracker="cve" id="2025-61140"/>
  <issue tracker="bnc" id="1257841">VUL-0: CVE-2026-25547: golang-github-prometheus-prometheus: brace-expansion: unbounded brace range expansion can lead to excessive CPU and memory consumption and may crash a Node.js process</issue>
  <issue tracker="bnc" id="1257442">VUL-0: CVE-2025-61140: golang-github-prometheus-prometheus: jsonpath: the `value` function is vulnerable to prototype pollution</issue>
  <issue tracker="bnc" id="1257329">VUL-0: CVE-2025-13465: golang-github-prometheus-prometheus: lodash: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global prototypes</issue>
  <issue tracker="bnc" id="1257897">VUL-0: CVE-2026-1615: golang-github-prometheus-prometheus: jsonpath: arbitrary code injection due to unsafe evaluation of user-supplied JSON Path expressions</issue>
  <issue tracker="bnc" id="1255588">VUL-0: CVE-2025-12816: golang-github-prometheus-prometheus: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications</issue>
  <issue tracker="jsc" id="PED-13824"/>
  <packager>PSuarezHernandez</packager>
  <rating>important</rating>
  <category>security</category>
  <summary>Security update for Prometheus </summary>
  <description>This update for Prometheus fixes the following issues:

golang-github-prometheus-alertmanager, golang-github-prometheus-node_exporter: 

- Internal changes to fix build issues with no impact for customers   

golang-github-prometheus-prometheus:

- Security issues fixed:

  * CVE-2026-27606: Fixed arbitrary file write via path traversal in rollup (bsc#1258893)
  * CVE-2026-25547: Fixed unbounded brace range expansion leading to excessive CPU and memory consumption (bsc#1257841)
  * CVE-2026-1615, CVE-2025-61140 The old web UI is no longer built due to security issues (bsc#1257897, bsc#1257442)
  * CVE-2025-13465: Bump lodash package to version 4.17.23 to fix prototype pollution vulnerability (bsc#1257329)
  * CVE-2025-12816: Interpretation conflict vulnerability allowing bypassing cryptographic verifications (bsc#1255588)

- Version update from 2.53.4 to 3.5.0 with the following highlighted changes (jsc#PED-13824):

  * Modernized Interface: Introduced a brand-new UI
  * Enhanced Cloud and Auth: Added unified AWS service discovery (EC2, ECS, Lightsail) and Azure Workload Identity support
    for more secure, native cloudauthentication.
  * Performance Standards: Fully integrated OpenTelemetry (OTLP) ingestion and moved Native Histograms from experimental
    to a stable feature.
  * Advanced Data Export: Rolled out Remote Write 2.0, offering better performance and metadata handling when sending
    data to external systems.
  * Query Power: Added new PromQL functions (like first_over_time and last_over_time) and optimization for grouping
    operations.
  * Better Visibility: The UI now displays detailed relabeling steps, scrape intervals, and timeouts, making it easier
    to troubleshoot why targets aren't reporting correctly.
  * Critical Fixes: Resolved significant memory leaks related to query logging and fixed bugs where targets were
    accidentally being scraped multiple times.
</description>
</patchinfo>