Every CVE Search/ Get API key

CVE-2022-29170

Grafana Enterprise datasource network restrictions bypass via HTTP redirects

6.6 MediumPublic exploitFix available

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
Low

Exploit likelihood

1.23%Up 0.3 points since May 21, 2022
90%50%10%1%

What each source reports

CVE List Score used 6.6

Grafana Enterprise datasource network restrictions bypass via HTTP redirects

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.

Record
CVE-2022-29170
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
Weakness
CWE-601
Updated
2026-11-02
EUVDEUVD-2022-33572 6.6

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.

Record
EUVD-2022-33572
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
Updated
2026-11-02
NVD 6.6

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.

Record
CVE-2022-29170
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS 2.0
4.9 MediumAV:N/AC:M/Au:S/C:P/I:P/A:N
Weakness
CWE-601
Updated
2026-11-02
OSVALPINE-CVE-2022-29170 8.5

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.

Record
ALPINE-CVE-2022-29170
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-03
OSV 6.6

Grafana Enterprise datasource network restrictions bypass via HTTP redirects

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.

Record
CVE-2022-29170
CVSS 3.1
6.6 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L
Weakness
CWE-601
Updated
2026-11-02
OSVOESA-2022-1711 8.5

grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0-beta1 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.(CVE-2022-29170)

Record
OESA-2022-1711
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated
2026-11-02
Show 7 moreShow less
OSVBIT-grafana-2022-29170 No score

Grafana Enterprise datasource network restrictions bypass via HTTP redirects

Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafana in a way so that the instance doesn’t call or only calls specific hosts. The vulnerability present starting with version 7.4.0 and prior to versions 7.5.16 and 8.5.3 allows someone to bypass these security configurations if a malicious datasource (running on an allowed host) returns an HTTP redirect to a forbidden host. The vulnerability only impacts Grafana Enterprise when the Request security allow list is used and there is a possibility to add a custom datasource to Grafana which returns HTTP redirects. In this scenario, Grafana would blindly follow the redirects and potentially give secure information to the clients. Grafana Cloud is not impacted by this vulnerability. Versions 7.5.16 and 8.5.3 contain a patch for this issue. There are currently no known workarounds.

Record
BIT-grafana-2022-29170
Updated
2026-11-02
OSVopenSUSE-SU-2024:12282-1 No score

grafana-8.5.10-1.1 on GA media

These are all security issues fixed in the grafana-8.5.10-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12282-1
Updated
2026-11-02
OSVSUSE-SU-2022:4428-1 No score

Security update for grafana

This update for grafana fixes the following issues:

Version update from 8.3.10 to 8.5.13 (jsc#PED-2145):

  • Security fixes:

    • CVE-2022-36062: (bsc#1203596)
    • CVE-2022-35957: (bsc#1203597)
    • CVE-2022-31107: (bsc#1201539)
    • CVE-2022-31097: (bsc#1201535)
    • CVE-2022-29170: (bsc#1199810)
    • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
    • CVE-2021-43798: (bsc#1193492)
    • CVE-2021-41244: (bsc#1192763)
    • CVE-2021-41174: (bsc#1192383)
    • CVE-2021-3711: (bsc#1189520)
    • CVE-2021-36222: (bsc#1188571)

  • Features and enhancements:

    • AccessControl: Disable user remove and user update roles when they do not have the permissions
    • AccessControl: Provisioning for teams
    • Alerting: Add custom grouping to Alert Panel
    • Alerting: Add safeguard for migrations that might cause dataloss
    • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
    • Alerting: Grafana uses > instead of >= when checking the For duration
    • Alerting: Move slow queries in the scheduler to another goroutine
    • Alerting: Remove disabled flag for data source when migrating alerts
    • Alerting: Show notification tab of legacy alerting only to editor
    • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
    • Alerting: Use expanded labels in dashboard annotations
    • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
    • Analytics: Add user id tracking to google analytics
    • Angular: Add AngularJS plugin support deprecation plan to docs site
    • API: Add usage stats preview endpoint
    • API: Extract OpenAPI specification from source code using go-swagger
    • Auth: implement auto_sign_up for auth.jwt
    • Azure monitor Logs: Optimize data fetching in resource picker
    • Azure Monitor Logs: Order subscriptions in resource picker by name
    • Azure Monitor: Include datasource ref when interpolating variables.
    • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
    • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
    • AzureMonitor: Filter list of resources by resourceType
    • AzureMonitor: Update allowed namespaces
    • BarChart: color by field, x time field, bar radius, label skipping
    • Chore: Implement OpenTelemetry in Grafana
    • Cloud Monitoring: Adds metric type to Metric drop down options
    • CloudMonitor: Correctly encode default project response
    • CloudWatch: Add all ElastiCache Redis Metrics
    • CloudWatch: Add Data Lifecycle Manager metrics and dimension
    • CloudWatch: Add Missing Elasticache Host-level metrics
    • CloudWatch: Add multi-value template variable support for log group names in logs query builder
    • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
    • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
    • Cloudwatch: Add support for new AWS/RDS EBS* metrics
    • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
    • Cloudwatch: Add template variable query function for listing log groups
    • Configuration: Add ability to customize okta login button name and icon
    • Elasticsearch: Add deprecation notice for < 7.10 versions.
    • Explore: Support custom display label for exemplar links for Prometheus datasource
    • Hotkeys: Make time range absolute/permanent
    • InfluxDB: Use backend for influxDB by default via feature toggle
    • Legend: Use correct unit for percent and count calculations
    • Logs: Escape windows newline into single newline
    • Loki: Add unpack to autocomplete suggestions
    • Loki: Use millisecond steps in Grafana 8.5.x.
    • Playlists: Enable sharing direct links to playlists
    • Plugins: Allow using both Function and Class components for app plugins
    • Plugins: Expose emotion/react to plugins to prevent load failures
    • Plugins: Introduce HTTP 207 Multi Status response to api/ds/query
    • Rendering: Add support for renderer token
    • Setting: Support configuring feature toggles…
Record
SUSE-SU-2022:4428-1
Updated
2026-11-02
OSVSUSE-SU-2022:4437-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

dracut-saltboot:

  • Update to version 0.1.1665997480.587fa10
    • Add dependencies on xz and gzip to support compressed images

golang-github-boynux-squid_exporter:

  • Exclude s390 architecture
  • Enhanced to build on Enterprise Linux 8.

grafana:

  • Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
  • Security fixes:
    • CVE-2022-36062: (bsc#1203596)
    • CVE-2022-35957: (bsc#1203597)
    • CVE-2022-31107: (bsc#1201539)
    • CVE-2022-31097: (bsc#1201535)
    • CVE-2022-29170: (bsc#1199810)
    • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
    • CVE-2021-43798: (bsc#1193492)
    • CVE-2021-41244: (bsc#1192763)
    • CVE-2021-41174: (bsc#1192383)
    • CVE-2021-3711: (bsc#1189520)
    • CVE-2021-36222: (bsc#1188571)
  • Features and enhancements:
    • AccessControl: Disable user remove and user update roles when they do not have the permissions
    • AccessControl: Provisioning for teams
    • Alerting: Add custom grouping to Alert Panel
    • Alerting: Add safeguard for migrations that might cause dataloss
    • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
    • Alerting: Grafana uses > instead of >= when checking the For duration
    • Alerting: Move slow queries in the scheduler to another goroutine
    • Alerting: Remove disabled flag for data source when migrating alerts
    • Alerting: Show notification tab of legacy alerting only to editor
    • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
    • Alerting: Use expanded labels in dashboard annotations
    • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
    • Analytics: Add user id tracking to google analytics
    • Angular: Add AngularJS plugin support deprecation plan to docs site
    • API: Add usage stats preview endpoint
    • API: Extract OpenAPI specification from source code using go-swagger
    • Auth: implement auto_sign_up for auth.jwt
    • Azure monitor Logs: Optimize data fetching in resource picker
    • Azure Monitor Logs: Order subscriptions in resource picker by name
    • Azure Monitor: Include datasource ref when interpolating variables.
    • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
    • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
    • AzureMonitor: Filter list of resources by resourceType
    • AzureMonitor: Update allowed namespaces
    • BarChart: color by field, x time field, bar radius, label skipping
    • Chore: Implement OpenTelemetry in Grafana
    • Cloud Monitoring: Adds metric type to Metric drop down options
    • CloudMonitor: Correctly encode default project response
    • CloudWatch: Add all ElastiCache Redis Metrics
    • CloudWatch: Add Data Lifecycle Manager metrics and dimension
    • CloudWatch: Add Missing Elasticache Host-level metrics
    • CloudWatch: Add multi-value template variable support for log group names in logs query builder
    • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
    • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
    • Cloudwatch: Add support for new AWS/RDS EBS* metrics
    • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
    • Cloudwatch: Add template variable query function for listing log groups
    • Configuration: Add ability to customize okta login button name and icon
    • Elasticsearch: Add deprecation notice for < 7.10 versions.
    • Explore: Support custom display label for exemplar links for Prometheus datasource
    • Hotkeys: Make time range absolute/permanent
    • InfluxDB: Use backend for influxDB by default via feature toggle
    • Legend: Use correct unit for percent and count calculations
    • Logs: Escape windows newline into single newline
    • Loki: Add unpack to autocomplete suggestions
    • Loki: Use millisecond steps in Grafana 8.5.x.
    • Playlists: Enable sharing direct links to playlists
    • Plugins: Allow using both Function and Class components for app plugins …
Record
SUSE-SU-2022:4437-1
Updated
2026-11-02
OSVSUSE-SU-2022:4439-1 No score

Security update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-boynux-squid_exporter:

  • Exclude s390 architecture
  • Enhanced to build on Enterprise Linux 8

grafana:

  • Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
  • Security fixes:
    • CVE-2022-36062: (bsc#1203596)
    • CVE-2022-35957: (bsc#1203597)
    • CVE-2022-31107: (bsc#1201539)
    • CVE-2022-31097: (bsc#1201535)
    • CVE-2022-29170: (bsc#1199810)
    • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
    • CVE-2021-43798: (bsc#1193492)
    • CVE-2021-41244: (bsc#1192763)
    • CVE-2021-41174: (bsc#1192383)
    • CVE-2021-3711: (bsc#1189520)
    • CVE-2021-36222: (bsc#1188571)
  • Features and enhancements:
    • AccessControl: Disable user remove and user update roles when they do not have the permissions
    • AccessControl: Provisioning for teams
    • Alerting: Add custom grouping to Alert Panel
    • Alerting: Add safeguard for migrations that might cause dataloss
    • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
    • Alerting: Grafana uses > instead of >= when checking the For duration
    • Alerting: Move slow queries in the scheduler to another goroutine
    • Alerting: Remove disabled flag for data source when migrating alerts
    • Alerting: Show notification tab of legacy alerting only to editor
    • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
    • Alerting: Use expanded labels in dashboard annotations
    • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
    • Analytics: Add user id tracking to google analytics
    • Angular: Add AngularJS plugin support deprecation plan to docs site
    • API: Add usage stats preview endpoint
    • API: Extract OpenAPI specification from source code using go-swagger
    • Auth: implement auto_sign_up for auth.jwt
    • Azure monitor Logs: Optimize data fetching in resource picker
    • Azure Monitor Logs: Order subscriptions in resource picker by name
    • Azure Monitor: Include datasource ref when interpolating variables.
    • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
    • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
    • AzureMonitor: Filter list of resources by resourceType
    • AzureMonitor: Update allowed namespaces
    • BarChart: color by field, x time field, bar radius, label skipping
    • Chore: Implement OpenTelemetry in Grafana
    • Cloud Monitoring: Adds metric type to Metric drop down options
    • CloudMonitor: Correctly encode default project response
    • CloudWatch: Add all ElastiCache Redis Metrics
    • CloudWatch: Add Data Lifecycle Manager metrics and dimension
    • CloudWatch: Add Missing Elasticache Host-level metrics
    • CloudWatch: Add multi-value template variable support for log group names in logs query builder
    • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
    • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
    • Cloudwatch: Add support for new AWS/RDS EBS* metrics
    • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
    • Cloudwatch: Add template variable query function for listing log groups
    • Configuration: Add ability to customize okta login button name and icon
    • Elasticsearch: Add deprecation notice for < 7.10 versions.
    • Explore: Support custom display label for exemplar links for Prometheus datasource
    • Hotkeys: Make time range absolute/permanent
    • InfluxDB: Use backend for influxDB by default via feature toggle
    • Legend: Use correct unit for percent and count calculations
    • Logs: Escape windows newline into single newline
    • Loki: Add unpack to autocomplete suggestions
    • Loki: Use millisecond steps in Grafana 8.5.x.
    • Playlists: Enable sharing direct links to playlists
    • Plugins: Allow using both Function and Class components for app plugins
    • Plugins: Expose emotion/react to plugins to prevent load failures
    • Plugins: Introduce HTTP 207 Multi Status response to…
Record
SUSE-SU-2022:4439-1
Updated
2026-11-02
OSVSUSE-SU-2024:0191-1 No score

Security Beta update for SUSE Manager Client Tools

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

  • Exclude s390 arch
  • Adapted to build on Enterprise Linux.
  • Fix build for RedHat 7
  • Require Go >= 1.14 also for CentOS
  • Add support for CentOS
  • Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

  • Do not strip if SUSE Linux Enterprise 15 SP3
  • Exclude debug for RHEL >= 8
  • Build with Go >= 1.20 when the OS is not RHEL
  • Fix apparmor profile for SLE 12
  • Upgrade to version 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Build using promu
  • Fix sandboxing options
  • Upgrade to version 0.13.4
    • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
  • Upgrade to version 0.13.3
    • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
  • Upgrade to version 0.13.1
    • Fix panic caused by missing flagConfig options
  • Upgrade to version 0.13.0
    • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
  • Corrected comment in AppArmor profile
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Update to upstream release 0.11.0 (jsc#SLE-24791)
    • Add TLS support
    • Switch to logger, please check --log.level and --log.format flags
  • Update to version 0.10.1
    • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
  • Update to version 0.10.0
    • Add Apache Proxy and other metrics
  • Update to version 0.8.0
    • Change commandline flags
    • Add metrics: Apache version, request duration total
  • Adapted to build on Enterprise Linux 8
  • Require building with Go 1.15
  • Add support for RedHat 8
    • Adjust dependencies on spec file
    • Disable dwarf compression in go build
  • Add support for Red Hat
  • Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

  • Do not create PIE for s390x architecture
  • Require Go 1.20 or newer for building
  • Remove not used build flags
  • Create position independent executables (PIE)
  • Disable striping the binaries only for SLE 15 SP3
  • Add System/Monitoring group tag
  • Rework service file to use obscpio
    • Run tar and recompress services at buildtime
    • Do not generate automatically changelog entries
  • Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
    • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
    • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
    • Templating: Fixed a race condition when using the title function. It is now race-safe
    • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
    • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
    • Clustering: Fixes a panic when tls_client_config is empty
    • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
    • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
    • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
    • Integrations: Add Microsoft Teams as a supported integration
  • Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
    • Fail configuration loading if api_key and api_key_file are defined at the same time
    • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
    • Trim contents of Slack API URLs when reading from files
    • amtool: Avoid panic when the label value matcher is empty
    • Fail configuration…
Record
SUSE-SU-2024:0191-1
Updated
2026-11-02
OSVSUSE-SU-2024:0196-1 No score

Security Beta update for SUSE Manager Client Tools and Salt

This update fixes the following issues:

ansible:

  • Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
    • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
    • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
    • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
  • Update to 2.9.22:
    • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
    • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
    • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
    • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
    • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

  • Update to version 0.1.1681904360.84ef141
    • Load network configuration even when missing protocol version (bsc#1210640)
  • Update to verion 0.1.1674034019.a93ff61
    • Install copied wicked config as client.xml (bsc#1205599)
  • Update to version 0.1.1673279145.e7616bd
    • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
    • Copy existing wicked config instead of generating new (bsc#1205599)
  • Update to version 0.1.1665997480.587fa10
    • Add dependencies on xz and gzip to support compressed images
  • Update to version 0.1.1661440542.6cbe0da
    • Use standard susemanager.conf
    • Move image services to dracut-saltboot package
    • Use salt bundle
  • Require e2fsprogs (bsc#1202614)
  • Update to version 0.1.1657643023.0d694ce
    • Update dracut-saltboot dependencies (bsc#1200970)
    • Fix network loading when ipappend is used in pxe config
    • Add new information messages

golang-github-QubitProducts-exporter_exporter:

  • Remove license file from %doc
  • Exclude s390 arch
  • Adapted to build on Enterprise Linux.
  • Fix build for RedHat 7
  • Require Go >= 1.14 also for CentOS
  • Add support for CentOS
  • Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

  • Do not strip if SUSE Linux Enterprise 15 SP3
  • Exclude debug for RHEL >= 8
  • Build with Go >= 1.20 when the OS is not RHEL
  • Spec file clean up
  • Fix apparmor profile for SLE 12
  • Do not build with apparmor profile for SLE 12
  • Upgrade to version 1.0.0 (jsc#PED-5405)
    • Improved flag parsing
    • Added support for custom headers
  • Build with Go 1.19
  • Build using promu
  • Add _service file
  • Fix sandboxing options
  • Upgrade to version 0.13.4
    • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
  • Upgrade to version 0.13.3
    • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
  • Upgrade to version 0.13.1
    • Fix panic caused by missing flagConfig options
  • Upgrade to version 0.13.0
    • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
  • Corrected comment in AppArmor profile
  • Added AppArmor profile
  • Added sandboxing options to systemd service unit
  • Exclude s390 architecture (gh#SUSE/spacewalk#19050)
  • Update to upstream release 0.11.0 (jsc#SLE-24791)
    • Add TLS support
    • Switch to logger, please check --log.level and --log.format flags
  • Update to version 0.10.1
    • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
  • Update to version 0.10.0
    • Add Apache Proxy and other metrics
  • Update to version 0.8.0
    • Change commandline flags
    • Add metrics: Apache version, request duration total
  • Adapted to build on Enterprise Linux 8
  • Require building with Go 1.15
  • Add support for RedHat 8
    • Adjust dependencies on spec file
    • Disable dwarf compression in go build
  • Add support for Red Hat
  • Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

  • Update to 2.45.0 (jsc#PED-5406):
    • [FEATURE] API:…
Record
SUSE-SU-2024:0196-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
grafana
Alpine:v3.16
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.17
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.18
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.19
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.20
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.21
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.22
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.23
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Alpine:v3.24
 7.4.0 up to 8.5.3-r0
8.5.3-r0
grafana
Bitnami
 7.4.0 up to 7.5.16, 8.0.0 up to 8.5.3
7.5.168.5.3
Show 79 moreShow less
Affected packages
PackageAffectedFixed
grafana
openEuler:20.03-LTS-SP1
 before 7.5.15-2.oe1
7.5.15-2.oe1
grafana
openEuler:20.03-LTS-SP3
 before 7.5.15-2.oe1
7.5.15-2.oe1
grafana
openEuler:22.03-LTS
 before 7.5.15-2.oe2203
7.5.15-2.oe2203
grafana
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 12 CVEs
 before 8.5.13-150200.3.29.5
8.5.13-150200.3.29.5
grafana
openSUSE:Leap 15.3
From an advisory covering 12 CVEs
 before 8.5.13-150200.3.29.5
8.5.13-150200.3.29.5
grafana
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 8.5.13-150200.3.29.5
8.5.13-150200.3.29.5
dracut-saltboot
SUSE:Manager Client Tools 15
From an advisory covering 12 CVEs
 before 0.1.1665997480.587fa10-150000.1.41.1
0.1.1665997480.587fa10-150000.1.41.1
golang-github-boynux-squid_exporter
SUSE:Manager Client Tools 15
From an advisory covering 12 CVEs
 before 1.6-150000.1.9.1
1.6-150000.1.9.1
grafana
SUSE:Manager Client Tools 15
From an advisory covering 12 CVEs
 before 8.5.13-150000.1.36.3
8.5.13-150000.1.36.3
prometheus-blackbox_exporter
SUSE:Manager Client Tools 15
From an advisory covering 12 CVEs
 before 0.19.0-150000.1.14.3
0.19.0-150000.1.14.3
spacecmd
SUSE:Manager Client Tools 15
From an advisory covering 12 CVEs
 before 4.3.16-150000.3.89.1
4.3.16-150000.3.89.1
spacewalk-client-tools
SUSE:Manager Client Tools 15
From an advisory covering 12 CVEs
 before 4.3.13-150000.3.71.3
4.3.13-150000.3.71.3
uyuni-proxy-systemd-services
SUSE:Manager Client Tools 15
From an advisory covering 12 CVEs
 before 4.3.7-150000.1.9.3
4.3.7-150000.1.9.3
dracut-saltboot
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 12 CVEs
 before 0.1.1665997480.587fa10-150000.1.41.1
0.1.1665997480.587fa10-150000.1.41.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 12 CVEs
 before 0.19.0-150000.1.14.3
0.19.0-150000.1.14.3
uyuni-proxy-systemd-services
SUSE:Manager Client Tools for SLE Micro 5
From an advisory covering 12 CVEs
 before 4.3.7-150000.1.9.3
4.3.7-150000.1.9.3
golang-github-boynux-squid_exporter
SUSE:Manager Proxy Module 4.2
From an advisory covering 12 CVEs
 before 1.6-150000.1.9.1
1.6-150000.1.9.1
prometheus-blackbox_exporter
SUSE:Manager Proxy Module 4.2
From an advisory covering 12 CVEs
 before 0.19.0-150000.1.14.3
0.19.0-150000.1.14.3
golang-github-boynux-squid_exporter
SUSE:Manager Proxy Module 4.3
From an advisory covering 12 CVEs
 before 1.6-150000.1.9.1
1.6-150000.1.9.1
prometheus-blackbox_exporter
SUSE:Manager Proxy Module 4.3
From an advisory covering 12 CVEs
 before 0.19.0-150000.1.14.3
0.19.0-150000.1.14.3
dracut-saltboot
openSUSE:Leap 15.3
From an advisory covering 12 CVEs
 before 0.1.1665997480.587fa10-150000.1.41.1
0.1.1665997480.587fa10-150000.1.41.1
golang-github-boynux-squid_exporter
openSUSE:Leap 15.3
From an advisory covering 12 CVEs
 before 1.6-150000.1.9.1
1.6-150000.1.9.1
golang-github-prometheus-promu
openSUSE:Leap 15.3
From an advisory covering 12 CVEs
 before 0.13.0-150000.3.9.1
0.13.0-150000.3.9.1
spacecmd
openSUSE:Leap 15.3
From an advisory covering 12 CVEs
 before 4.3.16-150000.3.89.1
4.3.16-150000.3.89.1
dracut-saltboot
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 0.1.1665997480.587fa10-150000.1.41.1
0.1.1665997480.587fa10-150000.1.41.1
golang-github-boynux-squid_exporter
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 1.6-150000.1.9.1
1.6-150000.1.9.1
golang-github-prometheus-promu
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 0.13.0-150000.3.9.1
0.13.0-150000.3.9.1
prometheus-blackbox_exporter
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 0.19.0-150000.1.14.3
0.19.0-150000.1.14.3
spacecmd
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 4.3.16-150000.3.89.1
4.3.16-150000.3.89.1
wire
openSUSE:Leap 15.4
From an advisory covering 12 CVEs
 before 0.5.0-150000.1.9.3
0.5.0-150000.1.9.3
golang-github-boynux-squid_exporter
SUSE:Manager Client Tools 12
From an advisory covering 12 CVEs
 before 1.6-1.9.1
1.6-1.9.1
grafana
SUSE:Manager Client Tools 12
From an advisory covering 12 CVEs
 before 8.5.13-1.36.2
8.5.13-1.36.2
prometheus-blackbox_exporter
SUSE:Manager Client Tools 12
From an advisory covering 12 CVEs
 before 0.19.0-1.14.1
0.19.0-1.14.1
spacecmd
SUSE:Manager Client Tools 12
From an advisory covering 12 CVEs
 before 4.3.16-38.112.1
4.3.16-38.112.1
spacewalk-client-tools
SUSE:Manager Client Tools 12
From an advisory covering 12 CVEs
 before 4.3.13-52.80.1
4.3.13-52.80.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.4.0-4.6.2
0.4.0-4.6.2
golang-github-boynux-squid_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.6-4.9.2
1.6-4.9.2
golang-github-lusitaniae-apache_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.0.0-4.12.4
1.0.0-4.12.4
golang-github-prometheus-alertmanager
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.26.0-4.12.4
0.26.0-4.12.4
golang-github-prometheus-node_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.5.0-4.15.4
1.5.0-4.15.4
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 2.45.0-4.33.3
2.45.0-4.33.3
golang-github-prometheus-promu
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.14.0-4.12.2
0.14.0-4.12.2
grafana
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 9.5.8-4.21.2
9.5.8-4.21.2
kiwi-desc-saltboot
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.1.1687520761.cefb248-4.15.2
0.1.1687520761.cefb248-4.15.2
mgr-push
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-4.21.4
5.0.1-4.21.4
prometheus-blackbox_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.24.0-3.6.3
0.24.0-3.6.3
prometheus-postgres_exporter
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 0.10.1-3.6.4
0.10.1-3.6.4
python-hwdata
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 2.3.5-15.12.2
2.3.5-15.12.2
rhnlib
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-24.30.3
5.0.1-24.30.3
spacecmd
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-41.42.3
5.0.1-41.42.3
supportutils-plugin-salt
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.2.2-9.9.2
1.2.2-9.9.2
supportutils-plugin-susemanager-client
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-9.15.2
5.0.1-9.15.2
system-user-grafana
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.0.0-3.7.2
1.0.0-3.7.2
system-user-prometheus
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 1.0.0-3.7.2
1.0.0-3.7.2
uyuni-common-libs
SUSE:Manager Client Tools 12-BETA
From an advisory covering 45 CVEs
 before 5.0.1-3.33.3
5.0.1-3.33.3
ansible
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 2.9.27-159000.3.9.1
2.9.27-159000.3.9.1
dracut-saltboot
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.1.1681904360.84ef141-159000.3.30.1
0.1.1681904360.84ef141-159000.3.30.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.4.0-159000.4.6.1
0.4.0-159000.4.6.1
golang-github-boynux-squid_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 1.6-159000.4.9.1
1.6-159000.4.9.1
golang-github-lusitaniae-apache_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 1.0.0-159000.4.12.1
1.0.0-159000.4.12.1
golang-github-prometheus-prometheus
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 2.45.0-159000.6.33.1
2.45.0-159000.6.33.1
grafana
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 9.5.8-159000.4.24.1
9.5.8-159000.4.24.1
mgr-push
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.4.21.1
5.0.1-159000.4.21.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.24.0-159000.3.6.1
0.24.0-159000.3.6.1
prometheus-postgres_exporter
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 0.10.1-159000.3.6.1
0.10.1-159000.3.6.1
python-hwdata
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 2.3.5-159000.5.13.1
2.3.5-159000.5.13.1
python-pyvmomi
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 6.7.3-159000.3.6.1
6.7.3-159000.3.6.1
rhnlib
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.30.1
5.0.1-159000.6.30.1
spacecmd
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.42.1
5.0.1-159000.6.42.1
spacewalk-client-tools
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.48.1
5.0.1-159000.6.48.1
supportutils-plugin-salt
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 1.2.2-159000.5.9.1
1.2.2-159000.5.9.1
supportutils-plugin-susemanager-client
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.6.15.1
5.0.1-159000.6.15.1
uyuni-common-libs
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.3.33.1
5.0.1-159000.3.33.1
uyuni-proxy-systemd-services
SUSE:Manager Client Tools 15-BETA
From an advisory covering 44 CVEs
 before 5.0.1-159000.3.9.1
5.0.1-159000.3.9.1
dracut-saltboot
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 0.1.1681904360.84ef141-159000.3.30.1
0.1.1681904360.84ef141-159000.3.30.1
golang-github-QubitProducts-exporter_exporter
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 0.4.0-159000.4.6.1
0.4.0-159000.4.6.1
prometheus-blackbox_exporter
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 0.24.0-159000.3.6.1
0.24.0-159000.3.6.1
uyuni-proxy-systemd-services
SUSE:Manager Client Tools Beta for SLE Micro 5
From an advisory covering 44 CVEs
 before 5.0.1-159000.3.9.1
5.0.1-159000.3.9.1
grafana
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 8.5.10-1.1
8.5.10-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubyijikeji/CVE-2022-291702023-01-29

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
first indexedCVE List, EUVD, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-29170 is a medium vulnerability (CVSS 6.6) in Grafana, published May 20, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in grafana 8.5.3-r0.

References

Show 151 moreShow less
This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open