Swift Prometheus is a Swift client for the Prometheus monitoring system, supporting counters, gauges and histograms. In code which applies _un-sanitized string values into metric names or labels_, an attacker could make use of this and send a `?lang` query parameter containing newlines, `}` or similar characters which can lead to the attacker taking over the exported format -- including creating unbounded numbers of stored metrics, inflating server memory usage, or causing "bogus" metrics. This vulnerability is fixed in2.0.0-alpha.2.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2024-03-29T14:26:22.194Z
Updated: 2024-06-04T18:03:18.312Z
Reserved: 2024-03-11T22:45:07.687Z
Link: CVE-2024-28867
JSON object: View
NVD Information
Status : Awaiting Analysis
Published: 2024-03-29T15:15:11.180
Modified: 2024-04-01T01:12:59.077
Link: CVE-2024-28867
JSON object: View
Redhat Information
No data.
CWE