Summary
Prometheus JMX Exporter is a JMX to Prometheus exporter: a collector that can be configured to scrape and expose MBeans of a JMX target.
Security Fix(es):
* SnakeYaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | prometheus-jmx-exporter | 0:0.12.0-9.el8_7 |
Vulnerabilities 1
-
High 8.3
Remote Code execution in SnakeYAML
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrust…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2150009