CVE-2022-23536
Description
Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Alertmanager service where `-experimental.alertmanager.enable-api` or `enable_api: true` is configured are affected. Affected Cortex users are advised to upgrade to patched versions 1.13.2 or 1.14.1. However as a workaround, Cortex administrators may reject Alertmanager configurations containing the `api_key_file` setting in the `opsgenie_configs` section before sending to the Set Alertmanager Configuration API.
How to fix
- github.com/cortexproject/cortex1.14.1, 1.13.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation cortex | 1.13.0, 1.13.1, 1.14.0 | — |
| github.com/cortexproject/cortexGo | 1.14.0 ≤ v < 1.14.1, 1.13.0 ≤ v < 1.13.2 | 1.14.1, 1.13.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.