FlawAtlas
Search the atlas
SUSE-SU-2026:3421-1 Not scored

Security update for prometheus-ha_cluster_exporter

This update for prometheus-ha_cluster_exporter fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266552). Other updates and bugfixes: - Release 1.4.2 * Use proper obs time format on changes generation. * Upgrade x/net to 0.57. * Full changelog *: https://github.com/ClusterLabs/ha_cluster_exporter/compare/1.4.1...1.4.2 - Release 1.4.1 * Upgrade to use go 1.25. * Bump github.com/prometheus/common from 0.59.1 to 0.61.0. * Bump golang.org/x/net from 0.33.0 to 0.55.0. * Full changelog: https://github.com/ClusterLabs/ha_cluster_exporter/compare/1.4.0...1.4.1 - Release 1.4.0 * add support to show overall cluster maintenance mode. * add supportconfig plugin (jsc#PED-2560). * update the CI workflow. * change default OBS development project. * bump required Go version to 1.23. * fix corosync collector parser when using IPv6 hostnames (#245). * Bump github.com/prometheus/client_model from 0.3.0 to 0.4.0 . * Bump github.com/prometheus/client_golang from 1.15.0 to 1.15.1 . * Bump github.com/prometheus/common from 0.42.0 to 0.44.0. * Bump github.com/spf13/viper from 1.15.0 to 1.16.0. * Bump github.com/stretchr/testify from 1.8.2 to 1.8.4. * Bump github.com/prometheus/client_golang from 1.15.1 to 1.16.0. * Bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0. * Bump golang.org/x/net from 0.10.0 to 0.17.0. * Bump github.com/prometheus/common from 0.44.0 to 0.55.0. * Bump github.com/spf13/viper from 1.16.0 to 1.19.0. * Bump actions/download-artifact from 3 to 4.1.7. * Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.2. * Bump github.com/prometheus/common from 0.55.0 to 0.59.1. * Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.4. * Bump github.com/prometheus/client_golang from 1.20.4 to 1.20.5. * Bump github.com/stretchr/testify from 1.9.0 to 1.10.0. * Bump golang.org/x/crypto from 0.26.0 to 0.31.0. * Full changelog: https://github.com/ClusterLabs/ha_cluster_exporter/compare/1.3.3...1.4.0

Exploit probability Not scored
Published July 30, 2026
Required by Not available
Last source change July 30, 2026

02 / AFFECTED SOFTWARE

Affected packages

SUSE:Linux Enterprise Server for SAP Applications 12 SP5 prometheus-ha_cluster_exporter

03 / CONNECTIONS

Connected vulnerabilities

04 / EVIDENCE

Source records

Open Source Vulnerabilities SUSE-SU-2026:3421-1

This update for prometheus-ha_cluster_exporter fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266552). Other updates and bugfixes: - Release 1.4.2 * Use proper obs time format on changes generation. * Upgrade x/net to 0.57. * Full changelog *: https://github.com/ClusterLabs/ha_cluster_exporter/compare/1.4.1...1.4.2 - Release 1.4.1 * Upgrade to use go 1.25. * Bump github.com/prometheus/common from 0.59.1 to 0.61.0. * Bump golang.org/x/net from 0.33.0 to 0.55.0. * Full changelog: https://github.com/ClusterLabs/ha_cluster_exporter/compare/1.4.0...1.4.1 - Release 1.4.0 * add support to show overall cluster maintenance mode. * add supportconfig plugin (jsc#PED-2560). * update the CI workflow. * change default OBS development project. * bump required Go version to 1.23. * fix corosync collector parser when using IPv6 hostnames (#245). * Bump github.com/prometheus/client_model from 0.3.0 to 0.4.0 . * Bump github.com/prometheus/client_golang from 1.15.0 to 1.15.1 . * Bump github.com/prometheus/common from 0.42.0 to 0.44.0. * Bump github.com/spf13/viper from 1.15.0 to 1.16.0. * Bump github.com/stretchr/testify from 1.8.2 to 1.8.4. * Bump github.com/prometheus/client_golang from 1.15.1 to 1.16.0. * Bump github.com/prometheus/client_golang from 1.16.0 to 1.17.0. * Bump golang.org/x/net from 0.10.0 to 0.17.0. * Bump github.com/prometheus/common from 0.44.0 to 0.55.0. * Bump github.com/spf13/viper from 1.16.0 to 1.19.0. * Bump actions/download-artifact from 3 to 4.1.7. * Bump github.com/prometheus/client_golang from 1.19.1 to 1.20.2. * Bump github.com/prometheus/common from 0.55.0 to 0.59.1. * Bump github.com/prometheus/client_golang from 1.20.2 to 1.20.4. * Bump github.com/prometheus/client_golang from 1.20.4 to 1.20.5. * Bump github.com/stretchr/testify from 1.9.0 to 1.10.0. * Bump golang.org/x/crypto from 0.26.0 to 0.31.0. * Full changelog: https://github.com/ClusterLabs/ha_cluster_exporter/compare/1.3.3...1.4.0

View original source

05 / REFERENCES

Further evidence