CVE-2022-31107

Today we are releasing Grafana 8.3.10, 8.4.10, 8.5.9 and 9.0.3. This patch release includes a HIGH severity security fix for an Oauth takeover vulnerability in Grafana.

Release v.9.0.3, containing this security fix and other patches:

• Download Grafana 9.0.3
• Release notes

Release v.8.5.9, containing this security fix and other fixes:

• Download Grafana 8.5.9
• Release notes

Release v.8.4.10, containing this security fix and other fixes:

• Download Grafana 8.4.10
• Release notes

Release v.8.3.10, containing this security fix and other fixes:

• Download Grafana 8.3.10

Grafana account takeover via OAuth vulnerability (CVE-2022-31107)

Summary

On June 27 the HTTPVoid team contacted Grafana Labs to disclose a Grafana account takeover via an OAuth vulnerability.

We believe that this vulnerability is rated at CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).

Impact

It is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP to take over an existing Grafana account under some conditions.

Affected versions with HIGH severity

All Grafana >=5.3 versions are affected by this vulnerability.

Solutions and mitigations

All installations after Grafana v5.3 should be upgraded as soon as possible.

As a workaround it is possible to disable any OAuth login or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Appropriate patches have been applied to Grafana Cloud and as always, we closely coordinated with all cloud providers licensed to offer Grafana Pro. They have received early notification under embargo and confirmed that their offerings are secure at the time of this announcement. This is applicable to Amazon Managed Grafana.

Timeline

Here is a detailed timeline starting from when we originally learned of the issue. All times in UTC.

2022-06-27 19:00 - Research submission of vulnerability report 2022-06-27 20:53 - Issue triaged, confirmed positive, and internal incident raised 2022-06-28 08:42 - Fix PR submitted and reviewed 2022-06-28 20:58 - All Grafana Cloud hosted Grafana instances patched 2022-07-05 07:14 - Customers informed under embargo 2022-07-14 02:00 - Public release

Acknowledgement

We would like to thank the HTTPVoid team for responsibly disclosing the vulnerability.

Reporting security issues

If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.(CVE-2022-31107)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: OAuth account takeover (CVE-2022-31107)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• grafana: OAuth account takeover (CVE-2022-31107)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es):

• grafana: OAuth account takeover (CVE-2022-31107) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es):

• grafana: OAuth account takeover (CVE-2022-31107) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Grafana is an open-source platform for monitoring and observability. In versions 5.3 until 9.0.3, 8.5.9, 8.4.10, and 8.3.10, it is possible for a malicious user who has authorization to log into a Grafana instance via a configured OAuth IdP which provides a login name to take over the account of another user in that Grafana instance. This can occur when the malicious user is authorized to log in to Grafana via OAuth, the malicious user's external user id is not already associated with an account in Grafana, the malicious user's email address is not already associated with an account in Grafana, and the malicious user knows the Grafana username of the target user. If these conditions are met, the malicious user can set their username in the OAuth provider to that of the target user, then go through the OAuth flow to log in to Grafana. Due to the way that external and internal user accounts are linked together during login, if the conditions above are all met then the malicious user will be able to log in to the target user's Grafana account. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch for this issue. As a workaround, concerned users can disable OAuth login to their Grafana instance, or ensure that all users authorized to log in via OAuth have a corresponding user account in Grafana linked to their email address.

Grafana account takeover via OAuth vulnerability in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana from v5.3.0 before v8.3.10, from v8.4.0 before v8.4.10, from v8.5.0 before v8.5.9, from v9.0.0 before v9.0.3.

These are all security issues fixed in the grafana-8.3.10-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Updated to version 8.5.13 (jsc#PED-2145, jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565):

• CVE-2022-36062: Fixed RBAC folders/dashboards privilege escalation (bsc#1203596).
• CVE-2022-35957: Fixed escalation from admin to server admin when auth proxy is used (bsc#1203597).
• CVE-2022-31107: Fixed OAuth account takeover (bsc#1201539).
• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-21702: Fixed XSS vulnerability in handling data sources (bsc#1195726).
• CVE-2022-21703: Fixed cross-origin request forgery vulnerability (bsc#1195727).
• CVE-2022-21713: Fixed Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728).
• CVE-2022-21673: Fixed missing error return in GetUserInfo if no user was found (bsc#1194873).
• CVE-2021-43815: Fixed directory traversal for .csv files (bsc#1193686).
• CVE-2021-41244: Fixed incorrect access control vulnerability(bsc#1192763).
• CVE-2021-41174: Fixed XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL (bsc#1192383).
• CVE-2021-3711: Fixed SM2 Decryption Buffer Overflow (bsc#1189520).
• CVE-2021-36222: Fixed a null pointer dereference in the KDC (bsc#1188571).
• CVE-2021-43798: Fixed arbitrary file read in the graph native plugin (bsc#1193492).

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not include sources (bsc#1200725)

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter. (bsc#1196338, jsc#SLE-24243, jsc#SUMA-114)

grafana:

• Update to version 8.3.10
  • Security:
    • CVE-2022-31097: Cross Site Scripting vulnerability in the Unified Alerting (bsc#1201535)
    • CVE-2022-31107: OAuth account takeover vulnerability (bsc#1201539)
• Update to version 8.3.9
  • Bug fixes:
    • Geomap: Display legend
    • Prometheus: Fix timestamp truncation
• Update to version 8.3.7
  • Bug fix:
    • Provisioning: Ensure that the default value for orgID is set when provisioning datasources to be deleted.
• Update to version 8.3.6
  • Features and enhancements:
    • Cloud Monitoring: Reduce request size when listing labels.
    • Explore: Show scalar data result in a table instead of graph.
    • Snapshots: Updates the default external snapshot server URL.
    • Table: Makes footer not overlap table content.
    • Tempo: Add request histogram to service graph datalink.
    • Tempo: Add time range to tempo search query behind a feature flag.
    • Tempo: Auto-clear results when changing query type.
    • Tempo: Display start time in search results as relative time.
    • CloudMonitoring: Fix resource labels in query editor.
    • Cursor sync: Apply the settings without saving the dashboard.
    • LibraryPanels: Fix for Error while cleaning library panels.
    • Logs Panel: Fix timestamp parsing for string dates without timezone.
    • Prometheus: Fix some of the alerting queries that use reduce/math operation.
    • TablePanel: Fix ad-hoc variables not working on default datasources.
    • Text Panel: Fix alignment of elements.
    • Variables: Fix for constant variables in self referencing links.
• Update to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565)

kiwi-desc-saltboot:

• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Use salt bundle
  • Add support fo VirtIO disks

mgr-daemon:

• Version 4.3.6-1
  • Update translation strings

spacecmd:

• Version 4.3.15-1
  • Process date values in spacecmd api calls (bsc#1198903)

spacewalk-client-tools:

• Version 4.3.12-1
  • Update translation strings

uyuni-common-libs:

• Version 4.3.6-1
  • Do not allow creating path if nonexistent user or group in fileutils.

This update fixes the following issues:

dracut-saltboot:

• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle

golang-github-lusitaniae-apache_exporter:

• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add %license macro for LICENSE file

grafana:

• Update to version 8.3.10
  • Security:
    • CVE-2022-31097: Cross Site Scripting vulnerability in the Unified Alerting (bsc#1201535)
    • CVE-2022-31107: Fixes OAuth account takeover vulnerability (bsc#1201539)
• Update to version 8.3.9
  • Bug fixes:
    • Geomap: Display legend
    • Prometheus: Fix timestamp truncation
• Update to version 8.3.7
  • Bug fix:
    • Provisioning: Ensure that the default value for orgID is set when provisioning datasources to be deleted.
• Update to version 8.3.6
  • Features and enhancements:
    • Cloud Monitoring: Reduce request size when listing labels.
    • Explore: Show scalar data result in a table instead of graph.
    • Snapshots: Updates the default external snapshot server URL.
    • Table: Makes footer not overlap table content.
    • Tempo: Add request histogram to service graph datalink.
    • Tempo: Add time range to tempo search query behind a feature flag.
    • Tempo: Auto-clear results when changing query type.
    • Tempo: Display start time in search results as relative time.
    • CloudMonitoring: Fix resource labels in query editor.
    • Cursor sync: Apply the settings without saving the dashboard.
    • LibraryPanels: Fix for Error while cleaning library panels.
    • Logs Panel: Fix timestamp parsing for string dates without timezone.
    • Prometheus: Fix some of the alerting queries that use reduce/math operation.
    • TablePanel: Fix ad-hoc variables not working on default datasources.
    • Text Panel: Fix alignment of elements.
    • Variables: Fix for constant variables in self referencing links.
• Update to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565)

mgr-daemon:

• Version 4.3.6-1
  • Update translation strings

spacecmd:

• Version 4.3.15-1
  • Process date values in spacecmd api calls (bsc#1198903)

spacewalk-client-tools:

• Version 4.3.12-1
  • Update translation strings

uyuni-common-libs:

• Version 4.3.6-1
  • Do not allow creating path if nonexistent user or group in fileutils.

This update for grafana fixes the following issues:

Updated to version 8.3.10 (jsc#SLE-24565, jsc#SLE-23422, jsc#SLE-23439):

• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-31107: Fixed OAuth account takeover vulnerability (bsc#1201539).
• CVE-2022-21702: Fixed XSS through attacker-controlled data source (bsc#1195726).
• CVE-2022-21703: Fixed Cross Site Request Forgery (bsc#1195727).
• CVE-2022-21713: Fixed Teams API IDOR (bsc#1195728).

This update for grafana fixes the following issues:

Version update from 8.3.10 to 8.5.13 (jsc#PED-2145):

• Security fixes:

  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)

• Features and enhancements:

  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to api/ds/query
  • Rendering: Add support for renderer token
  • Setting: Support configuring feature toggles…

This update fixes the following issues:

dracut-saltboot:

• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8.

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins …

This update fixes the following issues:

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to…

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

bind:

• Provide bind dependencies and solve installation issues on SUSE Linux Enterprise Micro
• There are no source changes

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from…

This update fixes the following issues:

grafana:

• Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
  • Security fixes:
    • CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
    • CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests (bnc#1210907)
    • CVE-2022-36062: grafana: Fix RBAC folders/dashboards privilege escalation (bsc#1203596)
    • CVE-2022-35957: grafana: Escalation from admin to server admin when auth proxy is used (bsc#1203597)
    • CVE-2022-32149: Upgrade x/text to version unaffected by CVE-2022-32149 (bsc#1204501)
    • CVE-2022-31107: grafana: OAuth account takeover (bsc#1201539)
    • CVE-2022-31097: grafana: stored XSS vulnerability (bsc#1201535)
    • CVE-2022-27664: go1.18,go1.19: net/http: handle server errors after sending GOAWAY (bsc#1203185)
    • CVE-2022-0155: follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor
    • CVE-2021-43138: spacewalk-web: a malicious user can obtain privileges via the mapValues() method(bsc#1200480)
    • CVE-2021-3918: json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (bsc#1192696)
    • CVE-2021-3807: node-ansi-regex: Inefficient Regular Expression Complexity in chalk/ansi-regex (bsc#1192154)
    • CVE-2020-7753: nodejs-trim: Regular Expression Denial of Service (ReDoS) in trim function
  • Important changes:
    • Default named retention policies won't be used to query. Users who have a default named retention policy in their influxdb database, have to rename it to something else. To change the hardcoded retention policy in the dashboard.json, users must then select the right retention policy from dropdown and save the panel/dashboard.
    • Grafana Alerting rules with NoDataState configuration set to Alerting will now respect 'For' duration.
    • Users who use LDAP role sync to only sync Viewer, Editor and Admin roles, but grant Grafana Server Admin role manually will not be able to do that anymore. After this change, LDAP role sync will override any manual changes to Grafana Server Admin role assignments. If grafana_admin is left unset in LDAP role mapping configuration, it will default to false.
    • The InfluxDB backend migration feature toggle (influxdbBackendMigration) has been reintroduced in this version as issues were discovered with backend processing of InfluxDB data. Unless this feature toggle is enabled, all InfluxDB data will be parsed in the frontend. This frontend processing is the default behavior. In Grafana 9.4.4, InfluxDB data parsing started to be handled in the backend. If you have upgraded to 9.4.4 and then added new transformations on InfluxDB data, those panels will fail to render. To resolve this either: Remove the affected panel and re-create it or edit the time field as Time in panel.json or dashboard.json
    • The @grafana/ui package helper function selectOptionInTest used in frontend tests has been removed as it caused testing libraries to be bundled in the production code of Grafana. If you were using this helper function in your tests please update your code accordingly.
    • Removed deprecated checkHealth prop from the @grafana/e2e addDataSource configuration. Previously this value defaulted to false, and has not been used in end-to-end tests since Grafana 8.0.3.
    • Removed the deprecated LegacyBaseMap, LegacyValueMapping, LegacyValueMap, and LegacyRangeMap types, and getMappedValue function from grafana-data. See the documentation for the migration. This change fixes a bug in Grafana where intermittent failure of database, network between Grafana and the database, or error in querying the database would cause all alert rules to be unscheduled in Grafana. Following…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

ansible:

• Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
  • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
  • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
• Update to 2.9.22:
  • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
  • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)
• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Copy existing wicked config instead of generating new (bsc#1205599)
• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images
• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle
• Require e2fsprogs (bsc#1202614)
• Update to version 0.1.1657643023.0d694ce
  • Update dracut-saltboot dependencies (bsc#1200970)
  • Fix network loading when ipappend is used in pxe config
  • Add new information messages

golang-github-QubitProducts-exporter_exporter:

• Remove license file from %doc
• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Spec file clean up
• Fix apparmor profile for SLE 12
• Do not build with apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build with Go 1.19
• Build using promu
• Add _service file
• Fix sandboxing options
• Upgrade to version 0.13.4
  • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
• Upgrade to version 0.13.3
  • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

• Update to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API:…