Bug 2564997
| Summary: | CVE-2026-119566 i2c-display: Prometheus: Information disclosure via HTTP redirects in remote write requests [fedora-43] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Ronit Dey <rdey> |
| Component: | i2c-display | Assignee: | Dennis Gilmore <dennis> |
| Status: | CLOSED NOTABUG | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 43 | CC: | dennis, go-sig |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["25196e4a-5954-423a-a8be-c008c0f98185"]} | ||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-11-03 03:56:00 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2563959 | ||
|
Description
Ronit Dey
2026-11-02 10:30:26 UTC
Not affected - two reasons.
1) The vulnerable code is not present in this package or in its SRPM.
CVE-2026-119566 lives in github.com/prometheus/common/config (http_config.go:
the bearer / basic-auth / OAuth2 round-trippers forwarded Authorization and
Cookie headers on cross-host redirects; fixed upstream in
https://github.com/prometheus/common/pull/901) and is reachable only from the
Prometheus *server* remote_write client (storage/remote/client.go,
storage/remote/azuread/azuread.go).
i2c-display imports only github.com/prometheus/client_golang/prometheus and
github.com/prometheus/client_golang/prometheus/promhttp, and only to expose its
own metrics endpoint server-side (internal/metrics/metrics.go). It has no
outbound net/http client, no remote_write support, and no cloud bearer
credentials of any kind, so there is no code path that can issue an
authenticated request, follow a redirect, and leak a token.
The dependency set is packaged per the go2rpm / go-vendor-tools convention: the
vendor archive is generated by go_vendor_archive from the Source0 tarball, so
vendor/modules.txt in the SRPM is authoritative for what is compiled. That
archive contains only prometheus/common/expfmt and prometheus/common/model:
$ tar -tjf i2c-display-0.5.6-vendor.tar.bz2 | grep -c 'prometheus/common/config/'
0
$ go list -deps ./cmd/... | grep prometheus/common
github.com/prometheus/common/model
github.com/prometheus/common/expfmt
common/config is neither vendored nor linked.
2) The pinned version already contains the upstream fix.
The fix landed in prometheus/common v0.69.0 (PR #901 merged 2026-06-11, released
2026-06-17). Version 0.5.6 in the archive pins v0.71.0, and the upcoming 0.5.7
pins v0.72.1 - both postdate the fix. No dependency update was required for this
CVE; the bump to v0.72.1 is routine hygiene.
This matches the statement on the flaw bug: exploitation requires a configured
remote_write endpoint using cloud provider bearer authentication, which this
package never configures or performs. It ships as a systemd service driving an
I2C OLED display on a single board computer; when metrics are enabled it only
serves a Prometheus text endpoint on the local network.
Verified at 0.5.6 and at HEAD with the refreshed vendor tree:
go build ./..., go vet ./... and go test ./... all pass.
Closing as NOTABUG.
|