Critical SUSE-RU-2024:0511-1 5 CVEs

Recommended update for grafana

Published Feb 15, 2024 · Updated Feb 4, 2026

Ecosystem: openSUSE Ecosystem: SUSE

Summary

This update for grafana fixes the following issues:

- Fixed changelog entries for the Bugzilla trackers related to previously implemented security fixes
(no source code changes)

Fixed packages 2

Release	Package	Fixed in
openSUSE · Leap 15.5	grafana	9.5.8-150200.3.53.2
SUSE · SLES 15 SP5 Linux Enterprise Module for Package Hub 15 SP5	grafana	9.5.8-150200.3.53.2

Vulnerabilities 5

Critical 9.8

CVE-2021-3918

Prototype Pollution in kriszyp/json-schema

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

kriszyp kriszyp/json-schema json-schema node-json-schema Debian Ubuntu npm

Nov 13, 2021
High 8.0

CVE-2022-0155 Public exploit

Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

follow-redirects follow-redirects/follow-redirects js-jquery node-follow-redirects Debian Ubuntu Azure Linux npm

Jan 10, 2022
High 7.8

CVE-2021-43138

Prototype Pollution in async

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

async npm

Apr 6, 2022
High 7.5

CVE-2020-7753

Regular Expression Denial of Service (ReDoS)

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

trim npm

Oct 27, 2020
High 7.5

CVE-2021-3807

Inefficient Regular Expression Complexity in chalk/ansi-regex

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

chalk chalk/ansi-regex node-ansi-regex node-ansi-regex Debian Ubuntu npm

Sep 17, 2021

References

report
https://bugzilla.suse.com/1192154
report
https://bugzilla.suse.com/1192696
report
https://bugzilla.suse.com/1200480
report
https://bugzilla.suse.com/1218843
report
https://bugzilla.suse.com/1218844
web
https://www.suse.com/security/cve/CVE-2020-7753
web
https://www.suse.com/security/cve/CVE-2021-3807
web
https://www.suse.com/security/cve/CVE-2021-3918
web
https://www.suse.com/security/cve/CVE-2021-43138
web
https://www.suse.com/security/cve/CVE-2022-0155