Summary
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* go-git: argument injection via the URL field (CVE-2025-21613)
* go-git: go-git clients vulnerable to DoS via maliciously crafted Git server replies (CVE-2025-21614)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | grafana | 9.2.10-21.el8_10 |
| AlmaLinux · 8 | grafana-selinux | 9.2.10-21.el8_10 |
Vulnerabilities 2
-
Critical 9.2
go-git has an Argument Injection via the URL field
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to…
-
High 7.5
go-git clients vulnerable to DoS via maliciously crafted Git server replies
go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing spec…