CVE-2018-12099

Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.

Grafana Cross-site Scripting (XSS) in github.com/grafana/grafana

This update for grafana, kafka, logstash, openstack-monasca-installer fixes the following issues:

Security issues fixed:

• CVE-2018-12099: grafana: Fix XSS vulnerabilities in dashboard links (bsc#1096985).
• CVE-2018-3817: logstash: Fix inadvertently logging of sensitive information (bsc#1090849).

Bug fixes:

• bsc#1095603: Disable jmxremote debugging.
• bsc#1097847: Make time series database schema setup conditional.
• bsc#1094448: Set log rotation options.
• bsc#1090336: Add complete set of elasticsearch performance tunables.
• bsc#1101366: Fix build issues with s390x, ppc64le and aarch64.
• Fix various spec errors affecting Leap 15 and Tumbleweed

This update for grafana, kafka, logstash and monasca-installer fixes the following issues:

The following security issues have been fixed:

grafana:

• CVE-2018-12099: Fix Cross-Site-Scripting (XSS) vulnerabilities in dashboard links. (bsc#1096985)

kafka:

• CVE-2018-1288: Authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. (bsc#1102920)

logstash:

• CVE-2018-3817: Fix potential leak of sensitive data when logging warnings about deprecated options. (bsc#1090849)

Additionally, the following non-security issues have been fixed:

monasca-installer:

• Add complete set of elasticsearch performance tunables.
• Update to version Build_20180427_14.04 (bsc#1090192, bsc#1090343)
• Fix bad elasticsearch-curator configuration. (bsc#1090192)
• Enable bootstrap.memory_lock for Elasticsearch. (bsc#1090343)

logstash:

• Declare Gemfile as config to prevent loss of installed plugins when updating.
• Stop installing prebuilt jruby for non-x86.

kafka:

• Update to version 0.10.2.2 (bsc#1102920, CVE-2018-1288)
• Add noreplace directive for /etc/kafka/server.properties.
• Reduce package ownership of tmpfiles.d to bare minium. (SLE12 SP2)
• Set log rotation options. (bsc#1094448)
• Disable jmxremote debugging. (bsc#1095603)
• Increase open file limits. (bsc#1086909)

This update for grafana to version 4.6.5 fixes the following issues:

Security issues fixed:

• CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383).
• CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960).
• CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515).
• CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985).
• CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862).

Non-security issue fixed:

• Solve wrongly categorized 'default.ini' file. (bsc#1167424) The configuration file was wrongly classified as documentation instead of configuration file. In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.