Red Hat Security Advisory: grafana security update

Fixed packages 4

Vulnerabilities 5

• Critical 9.8
  CVE-2024-24790

  Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

  The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

  Go standard library net/netip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024
• High 7.5
  CVE-2024-24791

  Denial of service due to improper 100-continue handling in net/http

  The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…

  Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jul 2, 2024
• Medium 6.0
  CVE-2024-6104

  go-retryablehttp can leak basic auth credentials to log files

  go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

  HashiCorp Shared library zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jun 24, 2024
• Medium 5.9
  CVE-2024-24788

  Malformed DNS message can cause infinite loop in net

  A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

  Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go
  May 8, 2024
• Medium 5.3
  CVE-2024-24789

  Mishandling of corrupt central directory record in archive/zip

  The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file…

  Go standard library archive/zip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292668
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292787
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2294000
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295310
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9115.json
• report
  https://access.redhat.com/security/cve/CVE-2024-6104
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-6104
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-6104
• report
  https://access.redhat.com/security/cve/CVE-2024-24788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24788
• advisory
  https://pkg.go.dev/vuln/GO-2024-2824
• report
  https://access.redhat.com/security/cve/CVE-2024-24789
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24789
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24789
• report
  https://access.redhat.com/security/cve/CVE-2024-24790
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24790
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24790
• report
  https://access.redhat.com/security/cve/CVE-2024-24791
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24791
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24791
• article
  https://go.dev/cl/591255
• article
  https://go.dev/issue/67555
• article
  https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ