Security update for grafana SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:1273-1 Final 1 1 2020-05-13T14:23:49Z current 2020-05-13T14:23:49Z 2020-05-13T14:23:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for grafana This update for grafana to version 4.6.5 fixes the following issues: Security issues fixed: - CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383). - CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960). - CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515). - CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985). - CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862). Non-security issue fixed: - Solve wrongly categorized 'default.ini' file. (bsc#1167424) The configuration file was wrongly classified as documentation instead of configuration file. In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2020-1273,SUSE-Storage-5-2020-1273 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/ Link for SUSE-SU-2020:1273-1 https://lists.suse.com/pipermail/sle-security-updates/2020-May/006815.html E-Mail link for SUSE-SU-2020:1273-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1096985 SUSE Bug 1096985 https://bugzilla.suse.com/1106515 SUSE Bug 1106515 https://bugzilla.suse.com/1115960 SUSE Bug 1115960 https://bugzilla.suse.com/1139862 SUSE Bug 1139862 https://bugzilla.suse.com/1148383 SUSE Bug 1148383 https://bugzilla.suse.com/1167424 SUSE Bug 1167424 https://www.suse.com/security/cve/CVE-2018-12099/ SUSE CVE CVE-2018-12099 page https://www.suse.com/security/cve/CVE-2018-15727/ SUSE CVE CVE-2018-15727 page https://www.suse.com/security/cve/CVE-2018-19039/ SUSE CVE CVE-2018-19039 page https://www.suse.com/security/cve/CVE-2018-558213/ SUSE CVE CVE-2018-558213 page https://www.suse.com/security/cve/CVE-2019-13068/ SUSE CVE CVE-2019-13068 page https://www.suse.com/security/cve/CVE-2019-15043/ SUSE CVE CVE-2019-15043 page SUSE Enterprise Storage 5 grafana-4.6.5-3.10.1 grafana-4.6.5-3.10.1 as a component of SUSE Enterprise Storage 5 Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links. CVE-2018-12099 SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/ https://www.suse.com/security/cve/CVE-2018-12099.html CVE-2018-12099 https://bugzilla.suse.com/1096985 SUSE Bug 1096985 https://bugzilla.suse.com/1172450 SUSE Bug 1172450 https://bugzilla.suse.com/1174583 SUSE Bug 1174583 https://bugzilla.suse.com/1175951 SUSE Bug 1175951 Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user. CVE-2018-15727 SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/ https://www.suse.com/security/cve/CVE-2018-15727.html CVE-2018-15727 https://bugzilla.suse.com/1106515 SUSE Bug 1106515 Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions. CVE-2018-19039 SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/ https://www.suse.com/security/cve/CVE-2018-19039.html CVE-2018-19039 https://bugzilla.suse.com/1115960 SUSE Bug 1115960 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-15727. Reason: This candidate is a reservation duplicate of CVE-2018-15727. Notes: All CVE users should reference CVE-2018-15727 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. CVE-2018-558213 SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/ https://www.suse.com/security/cve/CVE-2018-558213.html CVE-2018-558213 public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field). CVE-2019-13068 SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/ https://www.suse.com/security/cve/CVE-2019-13068.html CVE-2019-13068 https://bugzilla.suse.com/1139862 SUSE Bug 1139862 In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana. CVE-2019-15043 SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/ https://www.suse.com/security/cve/CVE-2019-15043.html CVE-2019-15043 https://bugzilla.suse.com/1148383 SUSE Bug 1148383