Security update for SUSE Manager Client Tools SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:2915-1 Final 1 1 2023-07-20T09:48:58Z current 2023-07-20T09:48:58Z 2023-07-20T09:48:58Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for SUSE Manager Client Tools This update fixes the following issues: grafana: - Update to version 9.5.5: * CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694) * Bug fixes: * Auth: Show invite button if disable login form is set to false. * Azure: Fix Kusto auto-completion for Azure datasources. * RBAC: Remove legacy AC editor and admin role on new dashboard route. * API: Revert allowing editors to access GET /datasources. * Settings: Add ability to override skip_org_role_sync with Env variables. - Update to version 9.5.3: * CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099) * CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100) - Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using `instant` queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits. - Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100 The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-2915,SUSE-SLE-Manager-Tools-15-2023-2915 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20232915-1/ Link for SUSE-SU-2023:2915-1 https://lists.suse.com/pipermail/sle-updates/2023-July/030439.html E-Mail link for SUSE-SU-2023:2915-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1212099 SUSE Bug 1212099 https://bugzilla.suse.com/1212100 SUSE Bug 1212100 https://bugzilla.suse.com/1212641 SUSE Bug 1212641 https://www.suse.com/security/cve/CVE-2023-2183/ SUSE CVE CVE-2023-2183 page https://www.suse.com/security/cve/CVE-2023-2801/ SUSE CVE CVE-2023-2801 page https://www.suse.com/security/cve/CVE-2023-3128/ SUSE CVE CVE-2023-3128 page SUSE Manager Tools 15 grafana-9.5.5-150000.1.51.1 grafana-9.5.5-150000.1.51.1 as a component of SUSE Manager Tools 15 Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix. CVE-2023-2183 SUSE Manager Tools 15:grafana-9.5.5-150000.1.51.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232915-1/ https://www.suse.com/security/cve/CVE-2023-2183.html CVE-2023-2183 https://bugzilla.suse.com/1212100 SUSE Bug 1212100 Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix. CVE-2023-2801 SUSE Manager Tools 15:grafana-9.5.5-150000.1.51.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232915-1/ https://www.suse.com/security/cve/CVE-2023-2801.html CVE-2023-2801 https://bugzilla.suse.com/1212099 SUSE Bug 1212099 Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app. CVE-2023-3128 SUSE Manager Tools 15:grafana-9.5.5-150000.1.51.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20232915-1/ https://www.suse.com/security/cve/CVE-2023-3128.html CVE-2023-3128 https://bugzilla.suse.com/1212641 SUSE Bug 1212641