Summary
[5.1.1-1]
- update to 5.1.1 tagged upstream community sources, see CHANGELOG
- resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
[5.0.0-4]
- update to 5.0.0 tagged upstream community sources, see CHANGELOG
- install plugin in /usr/share and create symlink from /var using
systemd-tmpfiles to work on rpm-ostree based distributions
- revert the breaking change (change of internal plugin IDs) of upstream v5.0.0,
i.e. there are no breaking changes when performing this upgrade
- enable Go modules in build process
- make vendor and webpack tarballs reproducible
- drop makefile in favor of create_bundles.sh script
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | grafana-pcp | 0:5.1.1-1.el9 |
Vulnerabilities 1
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.