Skip to content
OpenAdvisories
High RHSA-2024:8083 1 CVE

Red Hat Security Advisory: grafana security update

Published Oct 15, 2024 · Updated Aug 14, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream grafana 0:7.3.6-7.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream grafana-debuginfo 0:7.3.6-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream grafana 0:7.3.6-7.el8_4
Red Hat · RHEL 8.4 E4S rhel_e4s:8.4::appstream grafana-debuginfo 0:7.3.6-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream grafana 0:7.3.6-7.el8_4
Red Hat · RHEL 8.4 TUS rhel_tus:8.4::appstream grafana-debuginfo 0:7.3.6-7.el8_4

Vulnerabilities 1

  • High 8.2
    CVE-2024-21489

    uPlot Prototype Pollution vulnerability

    Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the attribute resolves to the object prototype.

    uplot npm

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2315838
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8083.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-21489
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-21489
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-21489
  • article
    https://github.com/leeoniya/uPlot/blob/c52e5001c1d959a99ac495a53e4deca5c44464d2/src/utils.js%23L437-L452
  • article
    https://github.com/leeoniya/uPlot/commit/5756e3e9b91270b303157e14bd0174311047d983
  • article
    https://security.snyk.io/vuln/SNYK-JS-UPLOT-6209224