CVE-2021-39226

Today we are releasing Grafana 7.5.11, and 8.1.6. These patch releases include an important security fix for an issue that affects all Grafana versions from 2.0.1.

Grafana Cloud instances have already been patched and an audit did not find any usage of this attack vector. Grafana Enterprise customers were provided with updated binaries under embargo.

8.1.5 contained a single fix for bar chart panels. We believe that users can expedite deployment by moving from 8.1.4 to 8.1.6 directly.

CVE-2021-39226 Snapshot authentication bypass

Summary

CVSS Score: 9.8 Critical CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

We received a security report to [email protected] on 2021-09-15 about a vulnerability in Grafana regarding the snapshot feature. It was later identified as affecting Grafana versions from 2.0.1 to 8.1.6. CVE-2021-39226 has been assigned to this vulnerability.

Impact

Unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths:

• /dashboard/snapshot/:key, or
• /api/snapshots/:key

If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path:

• /api/snapshots-delete/:deleteKey

Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths:

• /api/snapshots/:key, or
• /api/snapshots-delete/:deleteKey

The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.

Attack audit

While we can not guarantee that the below will identify all attacks, if you do find something with the below, you should consider doing a full assessment.

Through reverse proxy/load balancer logs

To determine if your Grafana installation has been exploited for this vulnerability, search through your reverse proxy/load balancer access logs for instances where the path is /dashboard/snapshot/:key, /api/snapshots/:key or /api/snapshots-delete/:deleteKey, and the response status code was 200 (OK). For example, if you’re using the Kubernetes ingress-nginx controller and sending logs to Loki, use a LogQL query like {job="nginx-ingress-controller"} |= "\"status\": 200" |= "\"uri\": \"/api/snapshots/:key\"".

Through the Grafana Enterprise audit feature

If you enabled “Log web requests” in your configuration with router_logging = true, look for "requestUri":"/api/snapshots-delete/”,“requestUri":"/api/snapshots/:key", or "type":"snapshot" in combination with "action":"delete".

Patched versions

Release 8.1.6:

• Download Grafana 8.1.6
• Release notes

Release 7.5.11:

• Download Grafana 7.5.11
• Release notes

Solutions and mitigations

Download and install the appropriate patch for your version of Grafana.

Grafana Cloud instances have already been patched, and Grafana Enterprise customers were provided with updated binaries under embargo.

Workaround

If for some reason you cannot upgrade:

You can use a reverse proxy or similar to block access to the literal paths

• /api/snapshots/:key
• /api/snapshots-delete/:deleteKey
• /dashboard/snapshot/:key
• /api/snapshots/:key

They have no normal function and can be disabled without side effects.

Timeline and postmortem

Here is a detailed timeline…

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.(CVE-2020-24303)

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-27846)

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.(CVE-2021-27358)

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.(CVE-2021-28148)

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.(CVE-2021-28147)

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to True (vs default of False), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)

Security Fix(es):

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)

Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension .md to authenticated users only. Grafana Cloud instances have not been affected by the vulnerability. Users should upgrade to patched versions 8.3.2 or 7.5.12. For users who cannot upgrade, running a reverse proxy in front of Grafana that normalizes the PATH of the request will mitigate the vulnerability. The proxy will have to also be able to handle url encoded paths. Alternatively, for fully lowercase or fully uppercase .md files, users can block /api/plugins/./markdown/. without losing any functionality beyond inlined plugin help text.(CVE-2021-43813)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: Snapshot authentication bypass (CVE-2021-39226)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.

This update for grafana fixes the following issues:

• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454)
• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688)

These are all security issues fixed in the grafana-7.5.11-3.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23422)

• Security:

  • CVE-2022-21702: XSS vulnerability in handling data sources (bsc#1195726)
  • CVE-2022-21703: cross-origin request forgery vulnerability (bsc#1195727)
  • CVE-2022-21713: Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728)
  • CVE-2022-21673: GetUserInfo: return an error if no user was found (bsc#1194873)
  • CVE-2021-43813, CVE-2021-43815, CVE-2021-41244, CVE-2021-41174, CVE-2021-43798, CVE-2021-39226.
  • Upgrade Docker base image to Alpine 3.14.3.
  • CVE-2021-3711: Docker: Force use of libcrypto1.1 and libssl1.1 versions
  • Update dependencies to fix CVE-2021-36222.
  • Upgrade Go to 1.17.2.
  • Fix stylesheet injection vulnerability.
  • Fix short URL vulnerability.

• License update:

  • AGPL License: Update license from Apache 2.0 to the GNU Affero General Public License (AGPL).

• Breaking changes:

  • Grafana 8 Alerting enabled by default for installations that do not use legacy alerting.
  • Keep Last State for 'If execution error or timeout' when upgrading to Grafana 8 alerting.
  • Fix No Data behaviour in Legacy Alerting.
  • The following endpoints were deprecated for Grafana v5.0 and support for them has now been removed:
    • GET /dashboards/db/:slug
    • GET /dashboard-solo/db/:slug
    • GET /api/dashboard/db/:slug
    • DELETE /api/dashboards/db/:slug
  • The default HTTP method for Prometheus data source is now POST.
  • Removes the never refresh option for Query variables.
  • Removes the experimental Tags feature for Variables.

• Deprecations:

  • The InfoBox & FeatureInfoBox are now deprecated please use the Alert component instead with severity info.

• Bug fixes:

  • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
  • Azure Monitor: Improved error messages for variable queries.
  • CloudMonitoring: Fixes broken variable queries that use group bys.
  • Configuration: You can now see your expired API keys if you have no active ones.
  • Elasticsearch: Fix handling multiple datalinks for a single field.
  • Export: Fix error when exporting dashboards using query variables that reference the default datasource.
  • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
  • Login: Page no longer overflows on mobile.
  • Plugins: Set backend metadata property for core plugins.
  • Prometheus: Fill missing steps with null values.
  • Prometheus: Fix interpolation of $__rate_interval variable.
  • Prometheus: Interpolate variables with curly brackets syntax.
  • Prometheus: Respect the http-method data source setting.
  • Table: Fixes issue with field config applied to wrong fields when hiding columns.
  • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
  • Variables: Fix so data source variables are added to adhoc configuration.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix…

This update for grafana fixes the following issues:

• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454)
• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688)

This update for grafana fixes the following issues:

• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454)
• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688)

This update fixes the following issues:

grafana:

• Update to version 7.5.12:
  • Fix markdown path traversal (#42969, bsc#1193688, CVE-2021-43813)
• Recreate tarballs using the makefile to update the npm and go modules required
• Update to version 7.5.11:
  • Fix Snapshot authentication bypass (bsc#1191454, CVE-2021-39226)
  • Fix certs issue (#40002)
  • Release v7.5.11 (#124)
  • Fix static path matching issue in macaron
  • OAuth: add docs for disableAutoLogin param (#38752) (#38894)
  • Fix #747; remove 'other variables'. (#37866) (#37878)
  • Update alert docs (#33658) (#33659)
  • [7.5.x] Docs: added documentation for the 'prepare time series'-transformation. (#36836)
  • cherry picked dc5778c303ca555b70e8ca8c28e95997e26ecfc1 (#36813)
  • 'Release: Updated versions in package to 7.5.10' (#36792)
  • [v7.5.x] Transformations: add 'prepare time series' transformer (#36749)
  • Remove verify-drone from windows (#36775)
  • Update queries.md (#31941) (#36764)
  • Updated content to specify method to use to get keyboard shortcuts; (#36084) (#36087)
  • ReleaseNotes: Updated changelog and release notes for 7.5.9 (#36057) (#36077)
  • 'Release: Updated versions in package to 7.5.9' (#36056)
  • Login: Fixes Unauthorized message showing when on login page or snapshot page (#35311) (#35880)
  • ReleaseNotes: Updated changelog and release notes for 7.5.8 (#35703) (#35822)
  • CI: Upgrade pipeline tool to use main (#35804)
  • CI: try to force v7.5.x instead of master (#35799)
  • CI: supports move from master to main in 7.5.x release branch (#35747)
  • 'Release: Updated versions in package to 7.5.8' (#35701)
  • Chore: Bump acorn and lodash-es (#35650)
  • Snapshots: Remove dashboard links from snapshots (#35567) (#35585)
  • [v7.5.x] Datasource: Allow configuring MaxConnsPerHost (#35519)
  • Remove docs sync from v7.5.x (#35443)
  • 'Release: Updated versions in package to 7.5.7' (#35412)
  • Add max_idle_connections_per_host to config (#35365)
  • Update go.sum to fix failing enterprise pipeline (#35353)
  • [v7.5.x] HTTP Client: Introduce go-conntrack (#35321)
  • Fix Markdown syntax in enterprise/license/_index.md (#34683) (#35210)
  • Update annotations.md (#33218) (#35138)
  • Docs: Add query caching to enterprise docs page (#34751) (#35025)
  • [7.5.x] Admin: hide per role counts for licensed users (#34994)
  • cleanup shortcodes, image paths (#34827)
  • Security: Upgrade Thrift dependency (#34698) (#34702)
  • Docs: Fix Quick Start link on Geting Started Influx page (#34549) (#34603)
  • Add link to release notes v7.5.7 (#34460) (#34474)
  • Update 7.5.x landing page (#34447)
  • ReleaseNotes: Updated changelog and release notes for 7.5.7 (#34383) (#34428)
• Update to 7.5.10
  • [v7.5.x] Transformations: add 'prepare time series' transformer. [#36749]
• Update to 7.5.9
  • Login: Fix Unauthorized message that is displayed on sign-in or snapshot page. [#35880]

kiwi-desc-saltboot:

• Update to version 0.1.1639488226.7c9eab9
  • Enable one-time autosign grains for SLE12 and SLE11 clients

mgr-cfg:

• Version 4.3.3-1
  • Fix python selinux package name depending on build target (bsc#1193600)
  • Do not build python 2 package for SLE15SP4 and higher

mgr-custom-info:

• Version 4.3.3-1
  • require python macros for building

mgr-osad:

• Version 4.3.3-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

mgr-push:

• Version 4.3.2-1
  • Do not build python 2 package for SLE15SP4 and higher

mgr-virtualization:

• Version 4.3.2-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

python-hwdata:

• Require python macros for building

rhnlib:

• Version 4.3.2-1
  • do not build python 2 package for SLE15

salt:

• Fix tmpfiles.d configuration for salt to not use legacy paths (bsc#1173103)
• Fix the regression of docker_container state module (bsc#1191285)

spacecmd:

• Version 4.3.5-1
  • require python macros for building …

This update fixes the following issues:

ansible:

• Require python macros for building

grafana:

• Update to version 7.5.12:
  • Fix markdown path traversal (#42969, bsc#1193688, CVE-2021-43813)
• Recreate tarballs using the makefile to update the npm and go modules required
• Update to version 7.5.11:
  • Fix Snapshot authentication bypass (bsc#1191454, CVE-2021-39226)
  • Fix certs issue (#40002)
  • Release v7.5.11 (#124)
  • Fix static path matching issue in macaron
  • OAuth: add docs for disableAutoLogin param (#38752) (#38894)
  • Fix #747; remove 'other variables'. (#37866) (#37878)
  • Update alert docs (#33658) (#33659)
  • [7.5.x] Docs: added documentation for the 'prepare time series'-transformation. (#36836)
  • cherry picked dc5778c303ca555b70e8ca8c28e95997e26ecfc1 (#36813)
  • 'Release: Updated versions in package to 7.5.10' (#36792)
  • [v7.5.x] Transformations: add 'prepare time series' transformer (#36749)
  • Remove verify-drone from windows (#36775)
  • Update queries.md (#31941) (#36764)
  • Updated content to specify method to use to get keyboard shortcuts wh… (#36084) (#36087)
  • ReleaseNotes: Updated changelog and release notes for 7.5.9 (#36057) (#36077)
  • 'Release: Updated versions in package to 7.5.9' (#36056)
  • Login: Fixes Unauthorized message showing when on login page or snapshot page (#35311) (#35880)
  • ReleaseNotes: Updated changelog and release notes for 7.5.8 (#35703) (#35822)
  • CI: Upgrade pipeline tool to use main (#35804)
  • CI: try to force v7.5.x instead of master (#35799)
  • CI: supports move from master to main in 7.5.x release branch (#35747)
  • 'Release: Updated versions in package to 7.5.8' (#35701)
  • Chore: Bump acorn and lodash-es (#35650)
  • Snapshots: Remove dashboard links from snapshots (#35567) (#35585)
  • [v7.5.x] Datasource: Allow configuring MaxConnsPerHost (#35519)
  • Remove docs sync from v7.5.x (#35443)
  • 'Release: Updated versions in package to 7.5.7' (#35412)
  • Add max_idle_connections_per_host to config (#35365)
  • Update go.sum to fix failing enterprise pipeline (#35353)
  • [v7.5.x] HTTP Client: Introduce go-conntrack (#35321)
  • Fix Markdown syntax in enterprise/license/_index.md (#34683) (#35210)
  • Update annotations.md (#33218) (#35138)
  • Docs: Add query caching to enterprise docs page (#34751) (#35025)
  • [7.5.x] Admin: hide per role counts for licensed users (#34994)
  • cleanup shortcodes, image paths (#34827)
  • Security: Upgrade Thrift dependency (#34698) (#34702)
  • Docs: Fix Quick Start link on Geting Started Influx page (#34549) (#34603)
  • Add link to release notes v7.5.7 (#34460) (#34474)
  • Update 7.5.x landing page (#34447)
  • ReleaseNotes: Updated changelog and release notes for 7.5.7 (#34383) (#34428)
• Update to 7.5.10
  • [v7.5.x] Transformations: add 'prepare time series' transformer. [#36749]
• Update to 7.5.9
  • Login: Fix Unauthorized message that is displayed on sign-in or snapshot page. [#35880]
• Drop drop-grafana-aws-sdk-0.3.0-module.patch (upstream)

mgr-cfg:

• Version 4.3.4-1
  • Fix installation problem for SLE15SP4 due missing python-selinux
  • Fix python selinux package name depending on build target (bsc#1193600)
  • Do not build python 2 package for SLE15SP4 and higher

mgr-custom-info:

• Version 4.3.3-1
  • require python macros for building

mgr-osad:

• Version 4.3.3-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

mgr-push:

• Version 4.3.2-1
  • Do not build python 2 package for SLE15SP4 and higher

mgr-virtualization:

• Version 4.3.2-1
  • require python macros for building
  • Do not build python 2 package for SLE15SP4 and higher

python-hwdata:

• Require python macros for building

rhnlib:

• Version 4.3.2-1
  • do not build python 2 package for SLE15

salt:

• Don't check for cached pillar errors on state.apply (bsc#1190781)

spacecmd:

• Version 4.3.5-1
  • require python macros for building

spacewalk-client-tools:

-…

This security update fixes the following issues:

golang-github-prometheus-prometheus:

• Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  • Bugfixes:
    • Scrape: Fix reporting metrics when sample limit is reached during the report. #9996
    • Scrape: Ensure that scrape interval and scrape timeout are always set. #10023
    • TSDB: Expose and fix bug in iterators' Seek() method. #10030
• Upgrade to upstream version 2.32.0
  • Change:
    • remote-write: Change default max retry time from 100ms to 5 seconds. #9634
  • Features:
    • Agent: New mode of operation optimized for remote-write only scenarios, without local storage.
    • Promtool: Add promtool check service-discovery command. #8970
  • Enhancements:
    • Promtool: Improve test output. #8064
    • Promtool: Use kahan summation for better numerical stability.
    • Remote-write: Reuse memory for marshalling. #9412
    • Scrape: Add scrape_body_size_bytes scrape metric behind the --enable-feature=extra-scrape-metrics flag. #9569
    • TSDB: Add windows arm64 support. #9703
    • TSDB: Optimize query by skipping unneeded sorting in TSDB.
    • Templates: Support int and uint as datatypes for template formatting. #9680
    • UI: Prefer rate over rad, delta over deg, and count over cos in autocomplete. #9688
    • TSDB: Add more size checks when writing individual sections in the index. #9710
    • PromQL: Make deriv() return zero values for constant series.
    • TSDB: Fix panic when checkpoint directory is empty. #9687
    • TSDB: Fix panic, out of order chunks, and race warning during WAL replay. #9856
    • UI: Correctly render links for targets with IPv6 addresses that contain a Zone ID. #9853
    • Promtool: Fix checking of authorization.credentials_file and bearer_token_file fields. #9883
    • Uyuni SD: Fix null pointer exception during initialization.
    • TSDB: Fix queries after a failed snapshot replay. #9980
• Upgrade to upstream version 2.31.1
  • Bugfix:
    • SD: Fix a panic when the experimental discovery manager receives targets during a reload. #9656
• Upgrade to upstream version 2.31.0
  • UI: Remove standard PromQL editor in favour of the codemirror-based editor. #9452
  • PromQL: Add trigonometric functions and atan2 binary operator. #9239 #9248 #9515
  • Remote: Add support for exemplar in the remote write receiver endpoint. #9319 #9414
  • SD: Add PuppetDB service discovery. #8883
  • SD: Add Uyuni service discovery. #8190
  • Web: Add support for security-related HTTP headers. #9546
  • Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  • Backfill: Add --max-block-duration in promtool create-blocks-from rules. #9511
  • Config: Print human-readable sizes with unit instead of raw numbers. #9361
  • HTTP: Re-enable HTTP/2. #9398
  • Kubernetes SD: Warn user if number of endpoints exceeds limit. #9467
  • OAuth2: Add TLS configuration to token requests. #9550
  • PromQL: Several optimizations. #9365 #9360 #9362 #9552
  • PromQL: Make aggregations deterministic in instant queries.
  • Rules: Add the ability to limit number of alerts or series.
  • SD: Experimental discovery manager to avoid restarts upon reload.
  • UI: Debounce timerange setting changes. #9359
  • Backfill: Apply rule labels after query labels. #9421
  • Scrape: Resolve conflicts between multiple exported label prefixes. #9479 #9518
  • Scrape: Restart scrape loops when scrape_interval is changed. #9551
  • TSDB: Fix memory leak in samples deletion. #9151
  • UI: Use consistent margin-bottom for all alert kinds. #9318
• Upgrade to upstream version 2.30.3
  • TSDB: Fix panic on failed snapshot replay. #9438
  • TSDB: Don't fail snapshot replay with exemplar storage disabled when the snapshot contains exemplars. #9438
• Upgrade to upstream version 2.30.2
  • TSDB: Don't error on…

This update fixes the following issues:

grafana:

• Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422)
  • Security:
    • Fixes XSS vulnerability in handling data sources (bsc#1195726, CVE-2022-21702)
    • Fixes cross-origin request forgery vulnerability (bsc#1195727, CVE-2022-21703)
    • Fixes Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728, CVE-2022-21713)
• Update to Go 1.17.
• Add build-time dependency on wire.
• Update license to GNU Affero General Public License v3.0.
• Update to version 8.3.4
  • GetUserInfo: return an error if no user was found (bsc#1194873, CVE-2022-21673)
  • Features and enhancements:
    • Alerting: Allow configuration of non-ready alertmanagers.
    • Alerting: Allow customization of Google chat message.
    • AppPlugins: Support app plugins with only default nav.
    • InfluxDB: query editor: skip fields in metadata queries.
    • Postgres/MySQL/MSSQL: Cancel in-flight SQL query if user cancels query in grafana.
    • Prometheus: Forward oauth tokens after prometheus datasource migration.
  • Bug fixes:
    • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
    • Azure Monitor: Improved error messages for variable queries.
    • CloudMonitoring: Fixes broken variable queries that use group bys.
    • Configuration: You can now see your expired API keys if you have no active ones.
    • Elasticsearch: Fix handling multiple datalinks for a single field.
    • Export: Fix error being thrown when exporting dashboards using query variables that reference the default datasource.
    • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
    • Login: Page no longer overflows on mobile.
    • Plugins: Set backend metadata property for core plugins.
    • Prometheus: Fill missing steps with null values.
    • Prometheus: Fix interpolation of $__rate_interval variable.
    • Prometheus: Interpolate variables with curly brackets syntax.
    • Prometheus: Respect the http-method data source setting.
    • Table: Fixes issue with field config applied to wrong fields when hiding columns.
    • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
    • Variables: Fix so data source variables are added to adhoc configuration.
  • Plugin development fixes & changes:
    • Toolkit: Revert build config so tslib is bundled with plugins to prevent plugins from crashing.
• Update to version 8.3.3:
  • BarChart: Use new data error view component to show actions in panel edit.
  • CloudMonitor: Iterate over pageToken for resources.
  • Macaron: Prevent WriteHeader invalid HTTP status code panic.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix so queryparam option works for scoped
• Update to version 8.3.2
  • Security: Fixes CVE-2021-43813 and CVE-2021-43815.
• Update to version 8.3.1
  • Security: Fixes CVE-2021-43798.
• Update to version…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update required Go version to 1.16
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400)

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch that is already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Apply patch to capture permission denied error for 'energy_uj' file (bsc#1190535)

grafana:

• Update to…

This update for ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, python-Django, rabbitmq-server, rubygem-puma fixes the following issues:

Security updates included on this update:

ardana-ansible, ardana-cobbler, grafana, openstack-heat-templates, openstack-murano, rabbitmq-server:

• CVE-2020-1734: Fixed vulnerability where shell was enabled by default in a pipe lookup plugin subprocess. (SOC-11662, bnc#1164139)
• CVE-2021-44716: Fixed uncontrolled memory consumption in go's net/http. (bsc#1193597)
• CVE-2019-11287: Fixed DoS via 'X-Reason' HTTP Header in malicious Erlang format string. (bsc#1157665)

grafana:

• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454).
• CVE-2021-44716: Fixed uncontrolled memory consumption in go's net/http (bsc#1193597).

python-Django:

• CVE-2022-28346: Fixed vulnerability that could lead to SQL injection in QuerySet.annotate(),aggregate() and extra(). (bsc#1198398)
• CVE-2022-34265: Fixed vulnerability that could lead to SQL injection via Trunc(kind) and Extract(lookup_name) arguments. (bsc#1201186)

rubygem puma:

• CVE-2022-24790: Fixed HTTP request smuggling vulnerability. (bsc#1197818)

Additional information about the this update:

Changes in ardana-ansible:

• Update to version 8.0+git.1660773729.3789a6d:
  • Mitigate CVE-2020-1734 (SOC-11662)

Changes in ardana-cobbler:

• Update to version 8.0+git.1660773402.d845a45:
  • Mitigate CVE-2020-1734 (SOC-11662)

Changes in grafana:

• Add CVE-2021-39226 patch (bsc#1191454, CVE-2021-39226)

  • snapshot authentication bypass

• Bump Go to 1.16 (bsc#1193597, CVE-2021-44716)

  • Fix Go net/http: limit growth of header canonicalization cache.

Changes in openstack-heat-templates:

• Update to version 0.0.0+git.1654529662.75fa04a:
  • doc: Comment out language option

Changes in openstack-murano:

• Update to version murano-4.0.2.dev3:
  • [stable-only] Remove periodic-stable-jobs template

Changes in openstack-murano:

• Update to version murano-4.0.2.dev3:
  • [stable-only] Remove periodic-stable-jobs template

Changes in rabbitmq-server:

• add explanation-format patch to fix CVE-2019-11287 (bsc#1157665)

Changes in python-Django:

• Rename Django-1.11.29.tar.gz.asc to Django-1.11.29.tar.gz.checksums.txt to avoid source_validator incorrectly trying to use it as a detached signature file for the sources tarball.

• Remove unnecessary project.diff file.

• Add CVE-2022-28346 patch (bsc#1198398, CVE-2022-28346)

  • Potential SQL injection in QuerySet.annotate(),aggregate() and extra()

• Add CVE-2022-34265 patch (bsc#1201186, CVE-2022-34265)

  • SQL injection via Trunc(kind) and Extract(lookup_name) arguments

Changes in rubygem-puma:

• Add CVE-2022-24790: Fixed HTTP request smuggling vulnerability (bsc#1197818).

This update for ardana-ansible, ardana-cobbler, ardana-tempest, grafana, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-neutron-gbp, openstack-nova, python-Django1, rabbitmq-server, rubygem-puma fixes the following issues:

Security fixes included in this update:

ardana-ansible:

• CVE-2020-1734: Fixed vulnerability where shell was enabled by default in a pipe lookup plugin subprocess (SOC-11662, bnc#1164139). grafana:
• CVE-2021-39226: Fixed snapshot authentication bypass (bsc#1191454). rabbitmq-server:
• CVE-2019-11287: Fixed DoS via 'X-Reason' HTTP Header in malicious Erlang format string (bsc#1157665). rubygem-puma:
• CVE-2022-24790: Fixed HTTP request smuggling (bsc#1197818). python-Django1:
• CVE-2022-28346: Fixed vulnerability allowing SQL injection in QuerySet.annotate(),aggregate() and extra() (bsc#1198398).
• CVE-2022-34265: Fixed vulnerability allowing SQL injection via Trunc(kind) and Extract(lookup_name) arguments (bsc#1201186). Bugfixes:
• Disabled two barbican tests (SOC-8764).

Non-security fixes included on this update:

Changes in ardana-ansible:

• Update to version 9.0+git.1660748476.c118d23:
  • Mitigate CVE-2020-1734 (SOC-11662)

Changes in ardana-cobbler:

• Update to version 9.0+git.1660747489.119efcd:
  • Mitigate CVE-2020-1734 (SOC-11662)

Changes in ardana-tempest:

• Update to version 9.0+git.1651855288.a2341ad:
  • Disable two barbican tests (SOC-8764)

Changes in grafana:

• Add CVE-2021-39226 patch (bsc#1191454, CVE-2021-39226)
  • snapshot authentication bypass

Changes in openstack-heat-templates:

• Update to version 0.0.0+git.1654529662.75fa04a7:
  • doc: Comment out language option

Changes in openstack-horizon-plugin-gbp-ui:

• Update to version group-based-policy-ui-14.0.1.dev4:
  • remove legacy servicechain code

Changes in openstack-neutron-gbp:

• Update to version group-based-policy-14.0.1.dev46:

  • Remove logs 2014.2.rc1

• Update to version group-based-policy-14.0.1.dev45:

  • FIP Status active after dissociate

• Update to version group-based-policy-14.0.1.dev43:

  • fixed apic synchronization state for multiple erspan session

• Update to version group-based-policy-14.0.1.dev41:

  • Remove_legacy_service_chain_code(2)

• Update to version group-based-policy-14.0.1.dev39:

  • data-migrations spelling fixes 2014.2rc1

• Update to version group-based-policy-14.0.1.dev38:

  • Adding support for address group feature in upstream

• Update to version group-based-policy-14.0.1.dev36:

  • Add support for yoga 2014.2.rc1

• Update to version group-based-policy-14.0.1.dev35:

  • Removed_legacy_service_chain_code 2014.2rc1

Changes in openstack-nova:

• Update to version nova-18.3.1.dev92:
  • [stable-only] Drop lower-constraints job

Changes in openstack-nova:

• Update to version nova-18.3.1.dev92:
  • [stable-only] Drop lower-constraints job

Changes in python-Djanjo1:

• Rename Django-1.11.29.tar.gz.asc to Django-1.11.29.tar.gz.checksums.txt to avoid source_validator incorrectly trying to use it as a detached signature file for the sources tarball.

• Add CVE-2022-28346 patch (bsc#1198398, CVE-2022-28346)

  • Potential SQL injection in QuerySet.annotate(),aggregate() and extra()

• Add CVE-2022-34265 patch (bsc#1201186, CVE-2022-34265)

  • SQL injection via Trunc(kind) and Extract(lookup_name) arguments

Changes in rabbitmq-server:

• add explanation-format patch to fix CVE-2019-11287 (bsc#1157665)

Changes in rubygem-puma:

• Add CVE-2022-24790 patch (bsc#1197818, CVE-2022-24790).

This update for grafana fixes the following issues:

Updated to version 7.5.12:

• CVE-2021-43813: Fixed markdown path traversal (bsc#1193688).
• CVE-2021-39226: Fixed Snapshot authentication bypass (bsc#1191454).

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…