Summary
[9.2.10-38.0.1]
- Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520]
[9.2.10-38]
- CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting
- Resolves RHEL-291857
[9.2.10-37]
- CVE-2026-116591 grafana: klauspost/compress: Denial of Service via crafted zstd compressed input
- Resolves RHEL-298352
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | grafana | 0:9.2.10-38.0.1.el8_10 |
| Oracle Linux · 8 | grafana-selinux | 0:9.2.10-38.0.1.el8_10 |
Vulnerabilities 2
-
High 8.7
compress zstd: Panic on two-block frames
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.…
-
High 7.1
CVE-2026-17183 CVE Record
An authenticated user with permission to create or edit alert rules can bypass datasource query authorization by marking an alert rule query as a server-side expression while referencing a real datasource UID (incorrect authorization). This can expose data ac…