Red Hat Security Advisory: grafana security and enhancement update

Fixed packages 3

Vulnerabilities 5

• High 7.5
  CVE-2022-27664

  golang.org/x/net/http2 Denial of Service vulnerability

  In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-hyperband katib-suggestion-pbt-enas Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2022
• Medium 6.6
  CVE-2022-35957

  Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

  Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full c…

  Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Alpine Go
  Sep 20, 2022
• Medium 4.3
  CVE-2022-39229

  Grafana users with email as a username can block other users from signing in

  Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username a…

  Grafana Grafana grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  Oct 13, 2022
• Unscored —
  CVE-2022-2880

  Incorrect sanitization of forwarded query parameters in net/http/httputil

  Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

  Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022
• Unscored —
  CVE-2022-41715

  Memory exhaustion when compiling regular expressions in regexp/syntax

  Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

  Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Oct 14, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2095421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2124669
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2125514
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2127218
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2131149
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2132872
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2167.json
• report
  https://access.redhat.com/security/cve/CVE-2022-2880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2880
• article
  https://github.com/golang/go/issues/54663
• article
  https://groups.google.com/g/golang-announce/c/xtuG5faxtaU?pli=1
• report
  https://access.redhat.com/security/cve/CVE-2022-27664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27664
• article
  https://go.dev/issue/54658
• article
  https://groups.google.com/g/golang-announce/c/x49AQzIVX-s/m/0tgO0pjiBQAJ
• report
  https://access.redhat.com/security/cve/CVE-2022-35957
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-35957
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-35957
• article
  https://github.com/grafana/grafana/security/advisories/GHSA-ff5c-938w-8c9q
• report
  https://access.redhat.com/security/cve/CVE-2022-39229
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-39229
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-39229
• report
  https://access.redhat.com/security/cve/CVE-2022-41715
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41715
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41715
• article
  https://github.com/golang/go/issues/55949