Red Hat Security Advisory: grafana security, bug fix, and enhancement update

Fixed packages 2

Vulnerabilities 15

• High 7.5
  CVE-2022-21698

  Uncontrolled Resource Consumption in promhttp

  client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Ser…

  prometheus client_golang cri-o dynamic-localpv-provisioner Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 15, 2022
• High 7.5
  CVE-2022-30630

  Stack exhaustion in Glob on certain paths in io/fs

  Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

  Go standard library io/fs golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• High 7.5
  CVE-2022-30631

  Stack exhaustion when reading certain archives in compress/gzip

  Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

  Go standard library compress/gzip golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• High 7.5
  CVE-2022-30633

  Stack exhaustion when unmarshaling certain documents in encoding/xml

  Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

  Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• High 7.5
  CVE-2022-30635

  Stack exhaustion when decoding certain messages in encoding/gob

  Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

  Go standard library encoding/gob golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.5
  CVE-2022-1705

  Improper sanitization of Transfer-Encoding headers in net/http

  Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.5
  CVE-2022-21702

  Cross site scripting in Grafana proxy

  Grafana is an open-source platform for monitoring and observability. In affected versions an attacker could serve HTML content thru the Grafana datasource or plugin proxy and trick a user to visit this HTML page using a specially crafted link and execute a Cr…

  Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  Feb 8, 2022
• Medium 6.5
  CVE-2022-32148

  Exposure of client IP addresses in net/http

  Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …

  Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 6.3
  CVE-2022-21703

  Cross Site Request Forgery in Grafana

  Grafana is an open-source platform for monitoring and observability. Affected versions are subject to a cross site request forgery vulnerability which allows attackers to elevate their privileges by mounting cross-origin attacks against authenticated high-pri…

  Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine Go
  Feb 8, 2022
• Medium 5.5
  CVE-2022-1962

  Stack exhaustion due to deeply nested types in go/parser

  Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

  Go standard library go/parser golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Medium 5.4
  CVE-2021-23648

  Cross-site Scripting (XSS)

  The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

  node-mermaid node-mermaid @braintree/sanitize-url Debian Ubuntu npm
  Mar 16, 2022
• Medium 4.3
  CVE-2022-21673

  OAuth Identity Token exposure in Grafana

  Grafana is an open-source platform for monitoring and observability. In affected versions when a data source has the Forward OAuth Identity feature enabled, sending a query to that datasource with an API token (and no other user credentials) will forward the …

  Grafana Grafana grafana grafana Web / CMS Ubuntu Alpine
  Jan 18, 2022
• Medium 4.3
  CVE-2022-21713

  Exposure of Sensitive Information in Grafana

  Grafana is an open-source platform for monitoring and observability. Affected versions of Grafana expose multiple API endpoints which do not properly handle user authorization. `/teams/:teamId` will allow an authenticated attacker to view unintended data by q…

  Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  Feb 8, 2022
• Unscored —
  CVE-2022-28131

  Stack exhaustion from deeply nested XML documents in encoding/xml

  Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

  Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022
• Unscored —
  CVE-2022-30632

  Stack exhaustion on crafted paths in path/filepath

  Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

  Go standard library path/filepath golang go Debian Ubuntu Azure Linux Alpine Go
  Aug 9, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2044628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2045880
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2050648
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2050742
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2050743
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2055349
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2065290
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2104367
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107371
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107374
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107376
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107383
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107386
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107390
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107392
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8057.json
• report
  https://access.redhat.com/security/cve/CVE-2021-23648
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23648
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23648
• article
  https://github.com/braintree/sanitize-url/pull/40
• article
  https://snyk.io/vuln/SNYK-JS-BRAINTREESANITIZEURL-2339882
• report
  https://access.redhat.com/security/cve/CVE-2022-1705
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1705
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1705
• article
  https://go.dev/issue/53188
• article
  https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE
• report
  https://access.redhat.com/security/cve/CVE-2022-1962
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1962
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1962
• article
  https://go.dev/issue/53616
• report
  https://access.redhat.com/security/cve/CVE-2022-21673
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-21673
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-21673
• article
  https://grafana.com/blog/2022/01/18/grafana-8.3.4-and-7.5.13-released-with-important-security-fix/
• report
  https://access.redhat.com/security/cve/CVE-2022-21698