Most recent entries from all

ALSA-2023:2167 — Moderate: grafana security and enhancement update

Affected: AlmaLinux:9: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) * grafana: Escalation from admin to server admin when auth proxy is used (CVE-2022-35957) * grafana: using email as a username can block other users from signing in (CVE-2022-39229) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2024-02622

BIT-grafana-2022-35957 — Authentication Bypass in Grafana via auth proxy allowing escalation from admin to server admin

Affected: Bitnami: grafana

Grafana is an open-source platform for monitoring and observability. Versions prior to 9.1.6 and 8.5.13 are vulnerable to an escalation from admin to server admin when auth proxy is used, allowing an admin to take over the server admin account and gain full control of the grafana instance. All installations should be upgraded as soon as possible. As a workaround deactivate auth proxy following the instructions at: https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/

certfr-2022-avi-845 — De multiples vulnérabilités ont été découvertes dans Grafana. Elles permettent à un attaquant de provoquer une élévatio…

certfr-2022-avi-845

EUVD-2026-266777

fkie_cve-2022-35957

GHSA-ff5c-938w-8c9q — Grafana Escalation from admin to server admin when auth proxy is used

Affected: Go: github.com/grafana/grafana

Today we are releasing Grafana 9.1.6, 9.0.9, 8.5.13. This patch release includes a Moderate severity security fix for CVE-2022-35957 that affects Grafana instances which are using Grafana [Auth Proxy](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/auth-proxy/#configure-auth-proxy-authentication).

Release 9.1.6, latest patch, also containing security fix:

- [Download Grafana 9.1.6](https://grafana.com/grafana/download/9.1.6) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-1-6/)

Release 9.0.9, only containing security fix:

- [Download Grafana 9.0.9](https://grafana.com/grafana/download/9.0.9) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-9-0-9/)

Release 8.5.13, only containing security fix:

- [Download Grafana 8.5.13](https://grafana.com/grafana/download/8.5.13) - [Release notes](https://grafana.com/docs/grafana/latest/release-notes/release-notes-8-5-13/)

Appropriate patches have been applied to [Grafana Cloud](https://grafana.com/cloud) and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana and Azure's Grafana as a service offering.

## Privilege escalation (CVE-2022-35957)

### Summary

On August 9 an internal security review…

gsd-2022-35957

OESA-2025-1186 — grafana security update

Affected: openEuler:24.03-LTS: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. Security Fix(es):

Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting.(CVE-2022-31097)

Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in the plugin signature verification. An attacker can convince a server admin to download and successfully run a malicious plugin even though unsigned plugins are not allowed. Versions 9.1.8 and 8.5.14 contain a patch for this issue. As a workaround, do not install plugins downloaded from untrusted sources.(CVE-2022-31123)

Grafana is an open source observability and data visualization platform. Versions of Grafana for endpoints prior to 9.1.8 and 8.5.14 could leak authentication tokens to some destination plugins under some conditions. The vulnerability impacts data source and plugin proxy endpoints with authentication tokens. The destination plugin could receive a user's Grafana…

openSUSE-SU-2024:12366-1 — grafana-8.5.13-1.1 on GA media

grafana-8.5.13-1.1 on GA media

RHSA-2023:3642 — Red Hat Security Advisory: Red Hat Ceph Storage 6.1 Container security and bug fix update

ramda: prototype poisoning eventsource: Exposure of Sensitive Information golang: net/http: improper sanitization of Transfer-Encoding header golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters marked: regular expression block.def may lead Denial of Service marked: regular expression inline.reflinkSearch may lead Denial of Service grafana: Use of Cache Containing Sensitive Information golang: encoding/pem: fix stack overflow in Decode Moment.js: Path traversal in moment.locale grafana: An information leak issue was discovered in Grafana through 7.3.4, when integrated with Zabbix golang: net/http: handle server errors after sending GOAWAY golang: encoding/xml: stack exhaustion in Decoder.Skip golang: crypto/elliptic: panic caused by oversized scalar golang: syscall: faccessat checks wrong group golang: crypto/tls: session tickets lack random ticket_age_add golang: io/fs: stack exhaustion in Glob golang: compress/gzip: stack exhaustion in Reader.Read golang: path/filepath: stack exhaustion in Glob golang: encoding/xml: stack exhaustion in Unmarshal golang: encoding/gob: stack exhaustion in Decoder.Decode grafana: stored XSS vulnerability grafana: OAuth account takeover grafana: plugin signature bypass grafana: data source and plugin proxy endpoints leaking authentication tokens to some destination plugins golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working golang: math/big: decoding big.Float and big.Rat…

SUSE-SU-2022:3676-1 — Security update for grafana

Security update for grafana

UBUNTU-CVE-2022-35957

Affected: Ubuntu:16.04:LTS: grafana

WID-SEC-W-2022-1486 — Grafana: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Grafana ausnutzen, um seine Privilegien zu erhöhen.