CVE-2023-0594

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

Grafana is an open-source platform for monitoring and observability.

Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization.

The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded.

An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript.

This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.

Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

This update fixes the following issues:

grafana version update from 8.5.20 to 8.5.22:

• Security issues fixed:

  • CVE-2023-1410: Fix XSS in Graphite functions tooltip (bsc#1209645)
  • CVE-2023-0507: Apply attribute sanitation to GeomapPanel (bsc#1208821)
  • CVE-2023-0594: Avoid storing XSS in TraceView panel (bsc#1208819)

• The following non-security bug was fixed:

  • Login: Fix panic when UpsertUser is called without ReqContext

This update fixes the following issues:

grafana version update from 8.5.20 to 8.5.22:

• Security issues fixed:

  • CVE-2023-1410: Fix XSS in Graphite functions tooltip (bsc#1209645)
  • CVE-2023-0507: Apply attribute sanitation to GeomapPanel (bsc#1208821)
  • CVE-2023-0594: Avoid storing XSS in TraceView panel (bsc#1208819)

• The following non-security bug was fixed:

  • Login: Fix panic when UpsertUser is called without ReqContext

This version update from 8.5.20 to 8.5.22 for grafana fixes the following issues:

• Security issues fixed:

  • CVE-2023-1410: Fix XSS in Graphite functions tooltip (bsc#1209645)
  • CVE-2023-0507: Apply attribute sanitation to GeomapPanel (bsc#1208821)
  • CVE-2023-0594: Avoid storing XSS in TraceView panel (bsc#1208819)

• The following non-security bug was fixed:

  • Login: Fix panic when UpsertUser is called without ReqContext

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

ansible:

• Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
  • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
  • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
• Update to 2.9.22:
  • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
  • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)
• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Copy existing wicked config instead of generating new (bsc#1205599)
• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images
• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle
• Require e2fsprogs (bsc#1202614)
• Update to version 0.1.1657643023.0d694ce
  • Update dracut-saltboot dependencies (bsc#1200970)
  • Fix network loading when ipappend is used in pxe config
  • Add new information messages

golang-github-QubitProducts-exporter_exporter:

• Remove license file from %doc
• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Spec file clean up
• Fix apparmor profile for SLE 12
• Do not build with apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build with Go 1.19
• Build using promu
• Add _service file
• Fix sandboxing options
• Upgrade to version 0.13.4
  • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
• Upgrade to version 0.13.3
  • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

• Update to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API:…