Grafana: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2023-28119

  crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb

  The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to…

  crewjam saml github.com/crewjam/saml golang-github-crewjam-saml Ubuntu Go
  Mar 22, 2023
• Medium 4.2
  CVE-2023-1387

  Grafana is an open-source platform for monitoring and observability. Starting with the 9.1 branch, Grafana introduced t…

  Grafana Grafana Grafana Enterprise grafana Web / CMS Ubuntu
  Apr 26, 2023

Revision history

1. 2024-02-08 #4

   Neue Updates von Red Hat aufgenommen

2. 2024-01-23 #3

   Neue Updates von SUSE aufgenommen

3. 2023-12-12 #2

   Neue Updates von Red Hat aufgenommen

4. 2023-04-26 #1

   Initiale Fassung

References

• Grafana Security Release vom 2023-04-26
  https://grafana.com/blog/2023/04/26/grafana-security-release-new-versions-of-grafana-with-security-fixes-for-cve-2023-28119-and-cve-2023-1387/
• Red Hat Security Advisory RHSA-2023:7741 vom 2023-12-12
  https://access.redhat.com/errata/RHSA-2023:7741
• SUSE Security Update SUSE-SU-2024:0196-1 vom 2024-01-23
  https://lists.suse.com/pipermail/sle-security-updates/2024-January/017743.html
• SUSE Security Update SUSE-SU-2024:0191-1 vom 2024-01-23
  https://lists.suse.com/pipermail/sle-security-updates/2024-January/017744.html
• Red Hat Security Advisory RHSA-2024:0746 vom 2024-02-08
  https://access.redhat.com/errata/RHSA-2024:0746