Skip to content
OpenAdvisories
Medium ELSA-2021-1859 2 CVEs

Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 8)

Published May 25, 2021 · Updated May 25, 2021

Ecosystem: Oracle Linux

Summary

[7.3.6-2]
- change working dir to in grafana-cli wrapper (fixes Red Hat BZ #1916083)
- add pcp-redis-datasource to allow_loading_unsigned_plugins config option

[7.3.6-1]
- update to 7.3.6 tagged upstream community sources, see CHANGELOG
- remove dependency on SAML (not supported in the open source version of Grafana)

[7.3.4-1]
- update to 7.3.4 tagged upstream community sources, see CHANGELOG
- bundle golang dependencies
- optionally bundle node.js dependencies and build and test frontend as part of the specfile
- merge all datasources into main grafana package
- change default provisioning path to /etc/grafana/provisioning
- resolve https://bugzilla.redhat.com/show_bug.cgi?id=1843170

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 8 grafana 0:7.3.6-2.el8

Vulnerabilities 2

  • Critical 9.8
    CVE-2020-27846

    XML Processing error in github.com/crewjam/saml

    A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

    github.com/crewjam/saml Go
  • Medium 6.1
    CVE-2020-24303

    Grafana XSS via a query alias for the ElasticSearch datasource

    Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

    grafana github.com/grafana/grafana Ubuntu Go