CVE-2018-19039

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

This update for grafana fixes the following issues:

grafana was updated to version 7.1.5:

• Features / Enhancements

  • Stats: Stop counting the same user multiple times.
  • Field overrides: Filter by field name using regex.
  • AzureMonitor: map more units.
  • Explore: Don't run queries on datasource change.
  • Graph: Support setting field unit & override data source (automatic) unit.
  • Explore: Unification of logs/metrics/traces user interface
  • Table: JSON Cell should try to convert strings to JSON
  • Variables: enables cancel for slow query variables queries.
  • TimeZone: unify the time zone pickers to one that can rule them all.
  • Search: support URL query params.
  • Grafana-UI: Add FileUpload.
  • TablePanel: Sort numbers correctly.

• Bug fixes

  • Alerting: remove LongToWide call in alerting.
  • AzureMonitor: fix panic introduced in 7.1.4 when unit was unspecified and alias was used.
  • Variables: Fixes issue with All variable not being resolved.
  • Templating: Fixes so texts show in picker not the values.
  • Templating: Templating: Fix undefined result when using raw interpolation format
  • TextPanel: Fix content overflowing panel boundaries.
  • StatPanel: Fix stat panel display name not showing when explicitly set.
  • Query history: Fix search filtering if null value.
  • Flux: Ensure connections to InfluxDB are closed.
  • Dashboard: Fix for viewer can enter panel edit mode by modifying url (but cannot not save anything).
  • Prometheus: Fix prom links in mixed mode.
  • Sign In Use correct url for the Sign In button.
  • StatPanel: Fixes issue with name showing for single series / field results
  • BarGauge: Fix space bug in single series mode.
  • Auth: Fix POST request failures with anonymous access
  • Templating: Fix recursive loop of template variable queries when changing ad-hoc-variable
  • Templating: Fixed recursive queries triggered when switching dashboard settings view
  • GraphPanel: Fix annotations overflowing panels.
  • Prometheus: Fix performance issue in processing of histogram labels.
  • Datasources: Handle URL parsing error.
  • Security: Use Header.Set and Header.Del for X-Grafana-User header.

These are all security issues fixed in the grafana-7.5.7-1.2 package on the GA media of openSUSE Tumbleweed.

This update provides package grafana for SUSE Manager: SLE12 Client Tools

This update provides package grafana for SUSE Manager: SLE15 Client Tools

This update for ardana package fixes the following issues:

• Update to version 9.0+git.1560211997.7ac9792:

  • Adds repository list parameter (bsc#1122825)

• Update to version 9.0+git.1557219331.457b6e7:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559292830.208d258:

  • Convert number of workers to int (SOC-9418)

• Update to version 9.0+git.1557424689.2b085d5:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1556225774.492d42c:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557220194.6a90deb:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219517.7b97993:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559039284.6fc1d47:

  • Convert number of workers to int (SOC-9384)

• Update to version 9.0+git.1558583814.a96bada:

  • Restrict rootwrap directories for cinder (bsc#1132542)

• Update to version 9.0+git.1557421539.521a486:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219553.d850ca4:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219586.7c96a6d:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219626.b190680:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1560868957.42bcb70:

  • MariaDB conf changes IPv6 (SOC-9089)

• Update to version 9.0+git.1559351643.a440414:

  • Configure xinted mysqlchk to accept ipv6 (SOC-9369)

• Update to version 9.0+git.1557219651.3d4d2d5:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1554995553.23d9513:

  • Configurable innodb flush options (SCRD-7496)

• Switch to new Gerrit Server

• Update to version 9.0+git.1558588538.9211022:

  • Secure designate's rootwrap files (bsc#1132542)

• Update to version 9.0+git.1558549508.9bfa9e7:

  • specify rootwrap config file in designate sudoer (bsc#1132542)

• Update to version 9.0+git.1557219686.0e71bf9:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559033522.5e5be1c:

  • Convert number of workers to int (SOC-9381)

• Update to version 9.0+git.1557421456.f1e5016:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219717.fe1bde6:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1559036788.b727b53:

  • Convert number of workers to int (SOC-9382)

• Update to version 9.0+git.1557421526.a8c13bf:

  • SCRD-8748 Fix default worker count determination logic (SCRD-8748)

• Update to version 9.0+git.1557219773.fe2f6aa:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557219807.6036a8e:

  • Update gerrit location (SCRD-9140)

• Switch to new Gerrit Server

• Update to version 9.0+git.1557220534.883f8c9:

  • Update gerrit location (SCRD-9140)

• Update to version 9.0+git.1557189507.c786525:

  • add external network to Ironic multi-tenancy input model (SCRD-8930)

• Update to version 9.0+git.1557189482.8931e67:

  • add neutron_l3_agent plugin (SCRD-8929)

• Switch to new Gerrit Server

• Update to version 9.0+git.1556199488.bdf1cdc:

  • SCRD-7471 Don't set external-name in ardana-ci models (SCRD-7471)

• Update to version 9.0+git.1559171053.476225c:

  • Move keystone error url to locale bundle (SOC-3456)
  • Add doc link to 503 error from Keystone (SOC-3456)

• Update to version 9.0+git.1558732415.467c8ab:

  • Consolidate setCloseButtonDisabled
  • Disable close button when playbook or action in progress
  • Disable close button when playbook or action in progress
  • Updated comments
  • Fixed an issue for replacing controller page
  • Prevent operations when…

This update for crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easy_diff, sleshammer fixes the following issues:

In python-pysaml2 the following security issue was fixed:

• CVE-2016-10127: Fixed an XML external entity attack. (bsc#1019074)

crowbar-core was updated to version 4.0+git.1570463621.40b11cd48:

• network: Don't set datapath-ids on ovs-bridges anymore (bsc#1152916)
• barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)
• gems: Update easy_diff to 1.0.0 (SOC-10505)
• crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
• transition.sh: Do not read /etc/crowbar.install.key
• gather_logs: Make it a bit useful again
• gather_logs: Do not read /etc/crowbar.install.key
• network: Allow locking down the network config for nodes (bsc#1120657)
• network: Check existing upper layers before bond setup (bsc#1120657)
• network: never plug two interface into the same ovs bridge (bsc#1120657)
• network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
• nic library: some helper for identifying base interface (bsc#1120657)
• network: Rework the vlan port replugging code (bsc#1120657)
• network: DRY out 'kill_nic_files' (noref)
• Add CVE-2019-5477 the to travis ignore list (SOC-9635)

crowbar-openstack was updated to version 4.0+git.1569429513.e7016b2b6:

• tempest: don't rely on service catalogue (SOC-10633)
• nova: set default attribute for max_threads_per_process
• database: Hardcode ruby version for package installation (SOC-10010)
• neutron: restore dhcp_domain in stable/4.0 (bsc#1145867)
• nova: add max_threads_per_process tuneable (SOC-10001, bsc#1133719)

grafana was updated to:

• CVE-2019-15043: Adds authentication to a few rest endpoints that could be used to access grafana snapshot apis to cause denial of service (SOC-10357 bsc#1148383) Also see https://github.com/grafana/grafana/compare/v5.4.4...v5.4.5

grafana was updated to version 4.6.5:

• CVE-2018-19039: Users with Editor or Admin permissions could exfiltrate files (jsc#SOC-9976 bsc#1115960)

grafana was updated version to 4.6.4:

• CVE-2018-15727 / CVE-2018-558213: Fixed an authentication bypass because an attacker can generate a valid 'remember me'cookie knowing only a username of an LDAP or OAuth user (jsc#SOC-9980 bsc#1106515)

Other fixes:

• sql: added code migration type
• release 4.6.3
• fix default alias
• fixes broken alert eval when first condition is using OR
• fix: alert list panel now works correctly after adding manual annotation on dashboard, fixes #9951
• fix: fix for avatar images when gzip is turned on, fixes #5952
• sets version to 4.6.2
• prom: add support for default step param (#9866)
• build: fixed jshint error
• fix: Html escaping caused issue in InfluxDB query editor, could not pick greater than or less then operators, fixes #9871
• heatmap: fix tooltip in 'Time series bucket' mode, #9332 (#9867)
• fix cloudwatch ec2_instance_attribute (#9718)
• colorpicker: fix color string change #9769 (#9780)
• changes version to 4.6.1
• fix: panel view now wraps, no scrolling required, fixes #9746
• plugins: fix for loading external plugins behind auth proxy, fixes #9509
• fix: color picker bug at series overrides page, #9715 (#9738)
• tech: switch to golang 1.9.2
• tech: add missing include
• save as should only delete threshold for panels with alerts
• fix: graphite annotation tooltip included undefined, fixes #9707
• build: updated version to v4.6.0
• plugins: added backward compatible path for rxjs
• ux: updated singlestat default colors
• prometheus: fixed unsaved changes warning when changing time range due to step option on query model was changed in datasource.query code, fixes #9675
• fix: firefox can now create region annotations, fixes #9638
• alerting: only editors can pause rules
• fix: another fix for playlist view state, #9639…

This update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone contains the following fixes:

• Update to version 8.0+git.1566374355.c509923:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 8.0+git.1566376789.be0fe01:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 8.0+git.1565816064.5d4f73f:

  • Removed None condition from rule (SOC-10003)

• Update to version 8.0+git.1566517401.98450e6:

  • Add neutron-fwaas.json when neutron-l3-agent is deployed (SOC-10280)

• Update to version 8.0+git.1568835837.2452e7a:

  • Ensure Manila services don't auto start on reboot (SOC-10641)

• Update to version 8.0+git.1568220097.74ee4b4:

  • API extension paths separated by colon (SOC-10447)

• Update to version 8.0+git.1567555448.5ecd5b0:

  • Add dependent services to neutron services (SOC-8746)

• Update to version 8.0+git.1566517377.f2a8c54:

  • Add policy.d/neutron-fwaas.json.j2 (SOC-10280)

• Update to version 8.0+git.1566902754.c58ff69:

  • Install libosinfo package (SOC-10295)

• Update to version 8.0+git.1565946419.a76c00e:

  • Set diskcachemode and disk discard when using RBD (SOC-10182)

• Update to version 8.0+git.1568373448.bcaee7e:

  • Make octavia heartbeat frequency options configurable (SOC-9285)

• Update to version 8.0+git.1566374572.a3c91d9:

  • Include SES variables when configuring image (SOC-9285)

• Update to version 8.0+git.1566208257.5213d93:

  • Use default values for amphora connection retries/timeout (SOC-9285)

• Update to version 8.0+git.1566471887.fd2fec7:

  • Delete existing run filter before deploying it (SOC-10287)

• Update to version 5.0+git.1569597589.1f025c557:

  • barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)

• Update to version 5.0+git.1569231378.ac645b753:

  • Revert 'batch: Use easy_merge for merging (SOC-10505)'

• Update to version 5.0+git.1569103607.ee4a6cbc9:

  • upgrade: Fix pie chart colors on dashboard (SOC-10619)

• Update to version 5.0+git.1568983947.70c39b8c7:

  • batch: Use easy_merge for merging (SOC-10505)

• Update to version 5.0+git.1568317972.dfb856def:

  • upgrade: Fix pre-checks tests (SOC-9868)
  • Allow designate rndc for all nodes (SOC-10339)

• Update to version 5.0+git.1568210854.4f87b86f8:

  • gems: Update easy_diff to 1.0.0 (SOC-10505)

• Update to version 5.0+git.1567531836.e06d68030:

  • Public ips for dns nodes when designate integration is in use (SOC-9635)

• Update to version 5.0+git.1567513044.e9ef28b03:

  • crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
  • transition.sh: Do not read /etc/crowbar.install.key
  • gather_logs: Make it a bit useful again
  • gather_logs: Do not read /etc/crowbar.install.key
  • network: Check existing upper layers before bond setup (bsc#1120657)
  • network: never plug two interface into the same ovs bridge (bsc#1120657)
  • network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
  • nic library: some helper for identifying base interface (bsc#1120657)
  • network: Rework the vlan port replugging code (bsc#1120657)
  • network: DRY out 'kill_nic_files' (noref)

• Update to version 5.0+git.1567161136.fa34ac9f2:

  • Add CVE-2019-5477 the to travis ignore list (SOC-9635)

• Update to version 5.0+git.1567094388.48f2be817:

  • upgrade: Add more prechecks for 8->9 (SOC-9868)

• Update…

This update for grafana to version 4.6.5 fixes the following issues:

Security issues fixed:

• CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383).
• CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960).
• CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515).
• CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985).
• CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862).

Non-security issue fixed:

• Solve wrongly categorized 'default.ini' file. (bsc#1167424) The configuration file was wrongly classified as documentation instead of configuration file. In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.

This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:

Security fixes included in this update:

cassandra:

• CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced correctly for certain internode_encryption settings (bsc#1181689)

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross site scripting vulnerabilities in the dashboard. (bsc#1172450)
• CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)
• CVE-2019-15043: Fixed a denial of service by an unauthenticated user in the snapshot HTTP API (bsc#1148383)
• CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)
• CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation popup (bsc#1170657)
• CVE-2018-19039: Fixed an issue where a privileged user could exfiltrate files (bsc#1115960)
• CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)
• CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for ElasticSearch datasources (bsc#1178243)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service. (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields. (bsc#1044849)
• CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used by default. (bsc#1171909)

python-Django:

• CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl(). (bsc#1182433)
• CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names. (bsc#1185623)
• CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView. (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks. (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)

python-pysaml2:

• CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed SAML documents. (bsc#1181277)
• CVE-2021-21239: Fixed improper verification of cryptographic signatures when using CryptoBackendXmlSec1(). (bsc#1181278)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions. (bsc#1183174)

Non-security changes included in this update:

Changes in ardana-neutron:

• Update to version 9.0+git.1615223676.777f0b3:
  • Allow users to stop monitoring rootwrap daemon (bsc#1182317)

Changes in ardana-swift:

• Update to version 9.0+git.1618235096.90974ed:
  • Run swiftlm-scan in the UTC timezone (bsc#1181690)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary…