Update module github.com/prometheus/alertmanager to v0.25.1 [SECURITY] (release-2.9.x) - autoclosed

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
github.com/prometheus/alertmanager	require	patch	v0.25.0 -> v0.25.1

---

Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

CVE-2023-40577 / GHSA-v86x-5fm3-5p7j

More information

Details

Impact

An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertmanager.

Patches

Users can upgrade to Alertmanager v0.2.51.

Workarounds

Users can setup a reverse proxy in front of the Alertmanager web server to forbid access to the /api/v1/alerts endpoint.

References

N/A

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j
• https://nvd.nist.gov/vuln/detail/CVE-2023-40577
• https://github.com/prometheus/alertmanager
• https://lists.debian.org/debian-lts-announce/2023/10/msg00011.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

prometheus/alertmanager (github.com/prometheus/alertmanager)

v0.25.1: 0.25.1 / 2023-08-23

Compare Source

• [SECURITY] Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (CVE-2023-40577).

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.