Summary
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
* grafana: Escalation from admin to server admin when auth proxy is used (CVE-2022-35957)
* grafana: using email as a username can block other users from signing in (CVE-2022-39229)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | grafana | 9.0.9-2.el9 |
Vulnerabilities 5
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
Medium 6.6
Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin
Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full c…
-
Medium 4.3
Grafana users with email as a username can block other users from signing in
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username a…
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…
References
-
report
https://access.redhat.com/security/cve/CVE-2022-27664
-
report
https://access.redhat.com/security/cve/CVE-2022-2880
-
report
https://access.redhat.com/security/cve/CVE-2022-35957
-
report
https://access.redhat.com/security/cve/CVE-2022-39229
-
report
https://access.redhat.com/security/cve/CVE-2022-41715
-
report
https://bugzilla.redhat.com/2124669
-
report
https://bugzilla.redhat.com/2125514
-
report
https://bugzilla.redhat.com/2131149
-
report
https://bugzilla.redhat.com/2132868
-
report
https://bugzilla.redhat.com/2132872
-
advisory
https://errata.almalinux.org/9/ALSA-2023-2167.html