CVE-2021-28147

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.(CVE-2020-24303)

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-27846)

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.(CVE-2021-27358)

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.(CVE-2021-28148)

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.(CVE-2021-28147)

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to True (vs default of False), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.

This update for grafana fixes the following issues:

• CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)

• Update to version 7.5.7:

  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model (#33572) (#33586)
  • Update team.md (#33454) (#33536)
  • Removed duplicate file 'dashboard_folder_permissions.md (#33497)
  • Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)
  • ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)
  • Documentation: Update developer-guide.md (#33478) (#33490)
  • add closed parenthesis to fix a hyperlink (#33471) (#33481)

• Update to version 7.5.5:

  • 'Release: Updated versions in package to 7.5.5' (#33469)
  • GraphNG: Fix exemplars window position (#33427) (#33462)
  • Remove field limitation from slack notification (#33113) (#33455)
  • Prometheus: Support POST in template variables (#33321) (#33441)
  • Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)
  • Docs: Removed type from find annotations example. (#33399) (#33403)
  • [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)
  • Updated label for add panel. (#33285) (#33286)
  • Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)
  • Docs: Sync latest master docs with 7.5.x (#33156)
  • Docs: Update getting-started-influxdb.md (#33234) (#33241)
  • Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)
  • Minor Changes in Auditing.md (#31435) (#33238)
  • Docs: Add license check endpoint doc (#32987) (#33236)
  • Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)
  • Docs: InfluxDB doc improvements (#32815) (#33185)
  • [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)
  • update cla (#33181)
  • Fix inefficient regular expression (#33155) (#33159)
  • Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)
  • Elasticsearch: Add documentation for supported Elasticsearch query transformations (#33072)…

This update fixes the following issues:

ansible:

• The support level for ansible is l2, not l3

dracut-saltboot:

• Force installation of libexpat.so.1 (bsc#1188846)
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE Linux Enterprise 15, 15 SP1, 15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  • TSDB: Do not panic when writing very large records to the WAL. #8790
  • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  • Scaleway Discovery: Fix nil pointer dereference. #8737
  • Consul Discovery: Restart no longer required after config update with no targets. #8766
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
• Update package with changes from server:monitoring (bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1's firewalld package does not contain 'prometheus' configuration yet.

mgr-cfg:

• No visible impact for the user

mgr-custom-info:

• No visible impact for the user

mgr-osad:

• No visible impact for the user

mgr-push:

• No visible impact for the user

mgr-virtualization:

• No visible impact for the user

rhnlib:

• No visible impact for the user

spacecmd:

• Make spacecmd aware of retracted patches/packages
• Enhance help for installation types when creating distributions (bsc#1186581)
• Parse empty argument when nothing in between the separator

spacewalk-client-tools:

• Update translation strings

spacewalk-koan:

• Fix for spacewalk-koan tests after switching to the new Docker images

spacewalk-oscap:

• No visible impact for the user

suseRegisterInfo:

• No visible impact for the user

uyuni-common-libs:

• Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650)
• Maintainer field in debian packages are only recommended (bsc#1186508)

This update was imported from the SUSE:SLE-15:Update update project.

This update for grafana fixes the following issues:

• CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)

• Update to version 7.5.7:

  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model (#33572) (#33586)
  • Update team.md (#33454) (#33536)
  • Removed duplicate file 'dashboard_folder_permissions.md (#33497)
  • Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)
  • ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)
  • Documentation: Update developer-guide.md (#33478) (#33490)
  • add closed parenthesis to fix a hyperlink (#33471) (#33481)

• Update to version 7.5.5:

  • 'Release: Updated versions in package to 7.5.5' (#33469)
  • GraphNG: Fix exemplars window position (#33427) (#33462)
  • Remove field limitation from slack notification (#33113) (#33455)
  • Prometheus: Support POST in template variables (#33321) (#33441)
  • Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)
  • Docs: Removed type from find annotations example. (#33399) (#33403)
  • [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)
  • Updated label for add panel. (#33285) (#33286)
  • Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)
  • Docs: Sync latest master docs with 7.5.x (#33156)
  • Docs: Update getting-started-influxdb.md (#33234) (#33241)
  • Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)
  • Minor Changes in Auditing.md (#31435) (#33238)
  • Docs: Add license check endpoint doc (#32987) (#33236)
  • Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)
  • Docs: InfluxDB doc improvements (#32815) (#33185)
  • [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)
  • update cla (#33181)
  • Fix inefficient regular expression (#33155) (#33159)
  • Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)
  • Elasticsearch: Add documentation for supported Elasticsearch query transformations (#33072)…

This update fixes the following issues:

ansible:

• The support level for ansible is l2, not l3

dracut-saltboot:

• Force installation of libexpat.so.1 (bsc#1188846)
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE Linux Enterprise 15, 15 SP1, 15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  • TSDB: Do not panic when writing very large records to the WAL. #8790
  • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  • Scaleway Discovery: Fix nil pointer dereference. #8737
  • Consul Discovery: Restart no longer required after config update with no targets. #8766
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
• Update package with changes from server:monitoring (bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1's firewalld package does not contain 'prometheus' configuration yet.

mgr-cfg:

• No visible impact for the user

mgr-custom-info:

• No visible impact for the user

mgr-osad:

• No visible impact for the user

mgr-push:

• No visible impact for the user

mgr-virtualization:

• No visible impact for the user

rhnlib:

• No visible impact for the user

spacecmd:

• Make spacecmd aware of retracted patches/packages
• Enhance help for installation types when creating distributions (bsc#1186581)
• Parse empty argument when nothing in between the separator

spacewalk-client-tools:

• Update translation strings

spacewalk-koan:

• Fix for spacewalk-koan tests after switching to the new Docker images

spacewalk-oscap:

• No visible impact for the user

suseRegisterInfo:

• No visible impact for the user

uyuni-common-libs:

• Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650)
• Maintainer field in debian packages are only recommended (bsc#1186508)

This update for grafana fixes the following issues:

• CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)

• Update to version 7.5.7:

  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model (#33572) (#33586)
  • Update team.md (#33454) (#33536)
  • Removed duplicate file 'dashboard_folder_permissions.md (#33497)
  • Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)
  • ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)
  • Documentation: Update developer-guide.md (#33478) (#33490)
  • add closed parenthesis to fix a hyperlink (#33471) (#33481)

• Update to version 7.5.5:

  • 'Release: Updated versions in package to 7.5.5' (#33469)
  • GraphNG: Fix exemplars window position (#33427) (#33462)
  • Remove field limitation from slack notification (#33113) (#33455)
  • Prometheus: Support POST in template variables (#33321) (#33441)
  • Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)
  • Docs: Removed type from find annotations example. (#33399) (#33403)
  • [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)
  • Updated label for add panel. (#33285) (#33286)
  • Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)
  • Docs: Sync latest master docs with 7.5.x (#33156)
  • Docs: Update getting-started-influxdb.md (#33234) (#33241)
  • Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)
  • Minor Changes in Auditing.md (#31435) (#33238)
  • Docs: Add license check endpoint doc (#32987) (#33236)
  • Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)
  • Docs: InfluxDB doc improvements (#32815) (#33185)
  • [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)
  • update cla (#33181)
  • Fix inefficient regular expression (#33155) (#33159)
  • Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)
  • Elasticsearch: Add documentation for supported Elasticsearch query transformations (#33072)…

This update fixes the following issues:

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:

  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SUSE Linux Enterprise 15, SP1, SP2

• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)

  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • TSDB: Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page.
    • TSDB: Do not panic when writing very large records to the WAL.
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed.
    • Scaleway Discovery: Fix nil pointer dereference.
    • Consul Discovery: Restart no longer required after config update with no targets.

• Update package with changes from server:monitoring (bsc#1175478) Left out removal of firewalld related configuration files as SLE-15-SP1's firewalld package does not contain prometheus configuration yet.

grafana:

• Update to version 7.5.7:
  • Updated relref to 'Configuring exemplars' section
  • Added exemplar topic
  • Quota: Do not count folders towards dashboard quota
  • Instructions to separate emails with semicolons
  • Docs: Remove documentation of v8 generic OAuth feature
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned
  • Add missing '--no-cache' to Dockerfile.
  • ReleaseNotes: Updated changelog and release notes for 7.5.6
  • Stop hoisting @icons/material
  • Chore: fix react-color version in yarn.lock.
  • 'Release: Updated versions in package to 7.5.6'
  • Loki: fix label browser crashing when + typed
  • Document hide_version flag
  • Add isolation level db configuration parameter
  • Sanitize PromLink button
  • Docs feedback: '/administration/provisioning.md'
  • Docs: delete from high availability docs references to removed configurations related to session storage
  • Docs: Update '_index.md'
  • Docs: Update 'installation.md'
  • GraphNG: uPlot 1.6.9
  • dont consider invalid email address a failed email
  • InfluxDB: Improve measurement-autocomplete behavior in query editor
  • add template for dashboard url parameters
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model
  • Update 'team.md'
  • Removed duplicate file 'dashboard_folder_permissions.md'
  • Document 'customQueryParameters' for prometheus datasource provisioning
  • ReleaseNotes: Updated changelog and release notes for 7.5.5
  • Documentation: Update 'developer-guide.md'
  • add closed parenthesis to fix a hyperlink
  • GraphNG: Fix exemplars window position
  • Remove field limitation from slack notification
  • Prometheus: Support POST in template variables
  • Instrumentation: Add success rate metrics for email notifications
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time)
  • Docs: Removed type from find annotations example.
  • FrontendMetrics: Adds new backend api that…

This update fixes the following issues:

ansible:

• The support level for ansible is l2, not l3

dracut-saltboot:

• Force installation of libexpat.so.1 (bsc#1188846)
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE Linux Enterprise 15, 15 SP1, 15 SP2
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
  • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
  • TSDB: Do not panic when writing very large records to the WAL. #8790
  • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
  • Scaleway Discovery: Fix nil pointer dereference. #8737
  • Consul Discovery: Restart no longer required after config update with no targets. #8766
  • Features:
    • Promtool: Retroactive rule evaluation functionality.
    • Configuration: Environment variable expansion for external labels. Behind '--enable-feature=expand-external-labels' flag.
    • Add a flag '--storage.tsdb.max-block-chunk-segment-size' to control the max chunks file size of the blocks for small Prometheus instances.
    • UI: Add a dark theme.
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery.
    • Docker Discovery: Add Docker Service Discovery.
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used.
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default.
  • Enhancements:
    • Digital Ocean Discovery: Add '__meta_digitalocean_vpc' label.
    • Scaleway Discovery: Read Scaleway secret from a file.
    • Scrape: Add configurable limits for label size and count.
    • UI: Add 16w and 26w time range steps.
    • Templating: Enable parsing strings in humanize functions.
• Update package with changes from server:monitoring (bsc#1175478) Left out removal of 'firewalld' related configuration files as SUSE Linux Enterprise 15-SP1's firewalld package does not contain 'prometheus' configuration yet.

mgr-cfg:

• No visible impact for the user

mgr-custom-info:

• No visible impact for the user

mgr-osad:

• No visible impact for the user

mgr-push:

• No visible impact for the user

mgr-virtualization:

• No visible impact for the user

rhnlib:

• No visible impact for the user

spacecmd:

• Make spacecmd aware of retracted patches/packages
• Enhance help for installation types when creating distributions (bsc#1186581)
• Parse empty argument when nothing in between the separator

spacewalk-client-tools:

• Update translation strings

spacewalk-koan:

• Fix for spacewalk-koan tests after switching to the new Docker images

spacewalk-oscap:

• No visible impact for the user

suseRegisterInfo:

• No visible impact for the user

uyuni-common-libs:

• Handle broken RPM packages to prevent exceptions causing fails on repository synchronization (bsc#1186650)
• Maintainer field in debian packages are only recommended (bsc#1186508)

This update fixes the following issues:

cobbler:

• Fixed rce in the xmlrpc which additionally allowed arbirtrary file read and write as root (bsc#1189458)

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SLE15, SLE15 SP1, SLE15 SP2
• Refresh patches
  • Changed:
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
• Upgrade to upstream version 2.27.0
  • Features:
    • Promtool: Retroactive rule evaluation functionality. #7675
    • Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
    • TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
    • UI: Add a dark theme. #8604
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
    • Docker Discovery: Add Docker Service Discovery. #8629
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
    • Scaleway Discovery: Read Scaleway secret from a file. #8643
    • Scrape: Add configurable limits for label size and count. #8777
    • UI: Add 16w and 26w time range steps. #8656
    • Templating: Enable parsing strings in humanize functions. #8682
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
    • TSDB: Do not panic when writing very large records to the WAL. #8790
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
    • Scaleway Discovery: Fix nil pointer dereference. #8737
    • Consul Discovery: Restart no longer required after config update with no targets. #8766
• Update package with changes from server:monitoring bsc#1175478 Left out removal of firewalld related configuration files as SLE-15-SP1's firewalld package does not contain prometheus configuration yet.

grafana:

• Add URL to package source code in the login page footer
• Update to version 7.5.7:
  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note…

This update fixes the following issues:

dracut-saltboot:

• Fix dependencies of python libs (bsc#1188846)
• Update to version 0.1.1628156312.dbd0dec
• Force installation of libexpat.so.1 (bsc#1188846)
• Update to version 0.1.1627546504.96a0b3e
• Use kernel parameters from PXE formula also for local boot

golang-github-prometheus-prometheus:

• Provide and reload firewalld configuration only for:
  • openSUSE Leap 15.0, 15.1, 15.2
  • SUSE SLE15, SLE15 SP1, SLE15 SP2
• Refresh patches
  • Changed:
• Upgrade to upstream version 2.27.1 (jsc#SLE-18254)
  • Bugfix:
  • SECURITY: Fix arbitrary redirects under the /new endpoint (CVE-2021-29622, bsc#1186242)
• Upgrade to upstream version 2.27.0
  • Features:
    • Promtool: Retroactive rule evaluation functionality. #7675
    • Configuration: Environment variable expansion for external labels. Behind --enable-feature=expand-external-labels flag. #8649
    • TSDB: Add a flag(--storage.tsdb.max-block-chunk-segment-size) to control the max chunks file size of the blocks for small Prometheus instances. #8478
    • UI: Add a dark theme. #8604
    • AWS Lightsail Discovery: Add AWS Lightsail Discovery. #8693
    • Docker Discovery: Add Docker Service Discovery. #8629
    • OAuth: Allow OAuth 2.0 to be used anywhere an HTTP client is used. #8761
    • Remote Write: Send exemplars via remote write. Experimental and disabled by default. #8296
  • Enhancements:
    • Digital Ocean Discovery: Add __meta_digitalocean_vpc label. #8642
    • Scaleway Discovery: Read Scaleway secret from a file. #8643
    • Scrape: Add configurable limits for label size and count. #8777
    • UI: Add 16w and 26w time range steps. #8656
    • Templating: Enable parsing strings in humanize functions. #8682
  • Bugfixes:
    • UI: Provide errors instead of blank page on TSDB Status Page. #8654 #8659
    • TSDB: Do not panic when writing very large records to the WAL. #8790
    • TSDB: Avoid panic when mmaped memory is referenced after the file is closed. #8723
    • Scaleway Discovery: Fix nil pointer dereference. #8737
    • Consul Discovery: Restart no longer required after config update with no targets. #8766
• Update package with changes from server:monitoring bsc#1175478 Left out removal of firewalld related configuration files as SLE-15-SP1's firewalld package does not contain prometheus configuration yet.

grafana:

• Add URL to package source code in the login page footer
• Update to version 7.5.7:
  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB:…