Skip to content
OpenAdvisories
High RHSA-2020:2796 8 CVEs

Red Hat Security Advisory: Red Hat OpenShift Service Mesh servicemesh-grafana security update

Published Sep 18, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-grafana 0:6.4.3-11.el8
Red Hat · Service Mesh 1 service_mesh:1.1::el8 servicemesh-grafana-prometheus 0:6.4.3-11.el8

Vulnerabilities 8

  • High 8.2
    CVE-2020-7662

    Regular Expression Denial of Service in websocket-extensions (NPM package)

    websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequen…

    js-jquery websocket-extensions Azure Linux npm
  • High 8.1
    CVE-2020-7660

    Insecure serialization leading to RCE in serialize-javascript

    serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

    serialize-javascript npm
  • High 7.5
    CVE-2019-11253 Scanner template EPSS 26%

    Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

    Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memo…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  • Medium 6.1
    CVE-2020-12245

    Grafana XSS in header column rename

    Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.

    grafana github.com/grafana/grafana Ubuntu Go
  • Medium 6.1
    CVE-2020-13430

    Grafana XSS via the OpenTSDB datasource

    Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.

    grafana github.com/grafana/grafana Ubuntu Go
  • Medium 5.8
    CVE-2020-13379 Public exploit Scanner template EPSS 100%

    Server Side Request Forgery in Grafana

    The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to…

    github.com/grafana/grafana grafana Alpine Go
  • Medium 4.2
    CVE-2019-16769

    Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

    The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since N…

    yahoo serialize-javascript serialize-javascript npm
  • Unscored —
    CVE-2020-12052

    Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

    grafana Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1757701
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1843640
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1844228
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1845982
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1848089
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1848092
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1848108
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1848643
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2796.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-11253
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-11253
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-11253
  • article
    https://www.stackrox.com/post/2019/09/protecting-kubernetes-api-against-cve-2019-11253-billion-laughs-attack/
  • report
    https://access.redhat.com/security/cve/CVE-2019-16769
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-16769
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-16769
  • report
    https://access.redhat.com/security/cve/CVE-2020-7660
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7660
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7660
  • report
    https://access.redhat.com/security/cve/CVE-2020-7662
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-7662
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-7662
  • article
    https://github.com/faye/websocket-extensions-node/security/advisories/GHSA-g78m-2chm-r7qv
  • report
    https://access.redhat.com/security/cve/CVE-2020-12052
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-12052
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-12052
  • report
    https://access.redhat.com/security/cve/CVE-2020-12245
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-12245
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-12245
  • report
    https://access.redhat.com/security/cve/CVE-2020-13379
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-13379
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-13379
  • article
    https://grafana.com/blog/2020/06/03/grafana-6.7.4-and-7.0.2-released-with-important-security-fix/
  • article
    https://www.openwall.com/lists/oss-security/2020/06/09/2/
  • report
    https://access.redhat.com/security/cve/CVE-2020-13430
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-13430
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-13430