Red Hat Security Advisory: grafana security and enhancement update

Fixed packages 3

Vulnerabilities 2

• Critical 9.8
  CVE-2022-37601

  Prototype pollution in webpack loader-utils

  Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

  reaper jitsucom-jitsu loader-utils node-loader-utils Debian Ubuntu Azure Linux Wolfi npm
  Oct 12, 2022
• Critical 9.4
  CVE-2023-3128 Public exploit

  Grafana vulnerable to Authentication Bypass by Spoofing

  Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.

  Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu Go
  Jun 22, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2193250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213626
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2224606
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_6972.json
• report
  https://access.redhat.com/security/cve/CVE-2022-37601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2134876
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-37601
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-37601
• article
  https://github.com/webpack/loader-utils/issues/212
• report
  https://access.redhat.com/security/cve/CVE-2023-3128
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-3128
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-3128
• article
  https://grafana.com/blog/2023/06/22/grafana-security-release-for-cve-2023-3128/