High ELSA-2024-8327 2 CVEs

Important: grafana security update (Oracle Linux 8)

Published Oct 22, 2024 · Updated Oct 22, 2024

Ecosystem: Oracle Linux

Summary

[9.2.10-20]
- Resolves RHEL-62307: CVE-2024-47875

[9.2.10-19]
- Resolves RHEL-61779: CVE-2024-9355

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 8	grafana	0:9.2.10-20.el8_10
Oracle Linux · 8	grafana-selinux	0:9.2.10-20.el8_10

Vulnerabilities 2

Critical 10.0

CVE-2024-47875 Public exploit

DOMPurify nesting-based mXSS

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

cure53 DOMPurify cacti argo-workflows Debian Ubuntu Wolfi npm

Oct 11, 2024
Medium 6.5

CVE-2024-9355

Golang-fips: golang fips zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go

Oct 1, 2024