Skip to content
OpenAdvisories
Medium ELSA-2020-1659 1 CVE

Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8)

Published May 5, 2020 · Updated May 5, 2020

Ecosystem: Oracle Linux

Summary

[6.3.6-1]
- add weak depenency on grafana-pcp
- add patch to mute shellcheck SC1090 for grafana-cli
- update to 6.3.6 upstream community sources, see CHANGELOG

[6.3.5-1]
- drop uaparser patch now its upstream
- add xerrors patch, see https://github.com/golang/go/issues/32246
- use vendor sources on rawhide until modules are fully supported
- update to latest upstream community sources, see CHANGELOG

[6.3.4-1]
- include fix for CVE-2019-15043
- add patch for uaparser on 32bit systems
- update to latest upstream community sources, see CHANGELOG

[6.2.5-1]
- update to latest upstream community sources, see CHANGELOG

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 8 grafana 0:6.3.6-1.el8
Oracle Linux · 8 grafana-azure-monitor 0:6.3.6-1.el8
Oracle Linux · 8 grafana-cloudwatch 0:6.3.6-1.el8
Oracle Linux · 8 grafana-elasticsearch 0:6.3.6-1.el8
Oracle Linux · 8 grafana-graphite 0:6.3.6-1.el8
Oracle Linux · 8 grafana-influxdb 0:6.3.6-1.el8
Oracle Linux · 8 grafana-loki 0:6.3.6-1.el8
Oracle Linux · 8 grafana-mssql 0:6.3.6-1.el8
Oracle Linux · 8 grafana-mysql 0:6.3.6-1.el8
Oracle Linux · 8 grafana-opentsdb 0:6.3.6-1.el8
Oracle Linux · 8 grafana-postgres 0:6.3.6-1.el8
Oracle Linux · 8 grafana-prometheus 0:6.3.6-1.el8
Oracle Linux · 8 grafana-stackdriver 0:6.3.6-1.el8

Vulnerabilities 1

  • Unscored —
    CVE-2019-15043 Public exploit Scanner template EPSS 63%

    In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run…

    grafana grafana Ubuntu Alpine