Summary
[6.7.4-3]
- apply patch for CVE-2020-13430 also to sources, not only to compiled webpack
[6.7.4-2]
- security fix for CVE-2020-13430
[6.7.4-1]
- update to 6.7.4 tagged upstream community sources, see CHANGELOG
- security fix for CVE-2020-13379
[6.7.3-1]
- update to 6.7.3 tagged upstream community sources, see CHANGELOG
- add scripts to list Go dependencies and bundled npmjs dependencies
- set Grafana version in Grafana UI and grafana-cli --version
- declare README.md as documentation of datasource plugins
- create grafana.db on first installation (fixes RH BZ #1805472)
- change permissions of /var/lib/grafana to 750 (CVE-2020-12458)
- change permissions of /var/lib/grafana/grafana.db to 640 and
user/group grafana:grafana (CVE-2020-12458)
- change permissions of grafana.ini and ldap.toml to 640 (CVE-2020-12459)
[6.6.2-1]
- added patch0 to set the version string correctly
- removed patch 004-xerrors.patch, its now upstream
- added several patches for golang vendored vrs build dep differences
- added patch to move grafana-cli binary to libexec dir
- update to 6.6.2 tagged upstream community sources, see CHANGELOG
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | grafana | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-azure-monitor | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-cloudwatch | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-elasticsearch | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-graphite | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-influxdb | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-loki | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-mssql | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-mysql | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-opentsdb | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-postgres | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-prometheus | 0:6.7.4-3.el8 |
| Oracle Linux · 8 | grafana-stackdriver | 0:6.7.4-3.el8 |
Vulnerabilities 8
-
Medium 6.5
Grafana Arbitrary File Read
Grafana <= 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations.
-
Medium 6.1
Grafana XSS via a column style
Grafana 5.3.1 has XSS via a column style on the "Dashboard > Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.
-
Medium 6.1
Grafana XSS in header column rename
Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.
-
Medium 6.1
Grafana XSS via the OpenTSDB datasource
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.
-
Medium 5.5
Grafana information disclosure
An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information (e.g., cleartext or encrypted dat…
-
Medium 5.5
Grafana world readable configuration files
In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.
-
Medium 5.4
Grafana stored XSS
Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.
-
Unscored —