High ELSA-2024-9473 2 CVEs

Important: grafana security update (Oracle Linux 9)

Published Nov 20, 2024 · Updated Nov 20, 2024

Ecosystem: Oracle Linux

Summary

[10.2.6-7]
- Resolves RHEL-62308: CVE-2024-47875

[10.2.6-6]
- Resolves: RHEL-57927

[10.2.6-5]
- Resolves RHEL-47185

Fixed packages 2

Release	Package	Fixed in
Oracle Linux · 9	grafana	0:10.2.6-7.el9_5
Oracle Linux · 9	grafana-selinux	0:10.2.6-7.el9_5

Vulnerabilities 2

Critical 10.0

CVE-2024-47875 Public exploit

DOMPurify nesting-based mXSS

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

cure53 DOMPurify cacti argo-workflows Debian Ubuntu Wolfi npm

Oct 11, 2024
High 7.5

CVE-2024-34156

Stack exhaustion in Decoder.Decode in encoding/gob

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Go standard library encoding/gob katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Sep 6, 2024