CVE-2018-15727

Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.

Grafana Authentication Bypass in github.com/grafana/grafana

This update for crowbar-core, crowbar-openstack, grafana, novnc, openstack-keystone, openstack-neutron, openstack-neutron-lbaas, openstack-nova, openstack-tempest, python-pysaml2, python-urllib3, rubygem-chef, rubygem-easy_diff, sleshammer fixes the following issues:

In python-pysaml2 the following security issue was fixed:

• CVE-2016-10127: Fixed an XML external entity attack. (bsc#1019074)

crowbar-core was updated to version 4.0+git.1570463621.40b11cd48:

• network: Don't set datapath-ids on ovs-bridges anymore (bsc#1152916)
• barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)
• gems: Update easy_diff to 1.0.0 (SOC-10505)
• crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
• transition.sh: Do not read /etc/crowbar.install.key
• gather_logs: Make it a bit useful again
• gather_logs: Do not read /etc/crowbar.install.key
• network: Allow locking down the network config for nodes (bsc#1120657)
• network: Check existing upper layers before bond setup (bsc#1120657)
• network: never plug two interface into the same ovs bridge (bsc#1120657)
• network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
• nic library: some helper for identifying base interface (bsc#1120657)
• network: Rework the vlan port replugging code (bsc#1120657)
• network: DRY out 'kill_nic_files' (noref)
• Add CVE-2019-5477 the to travis ignore list (SOC-9635)

crowbar-openstack was updated to version 4.0+git.1569429513.e7016b2b6:

• tempest: don't rely on service catalogue (SOC-10633)
• nova: set default attribute for max_threads_per_process
• database: Hardcode ruby version for package installation (SOC-10010)
• neutron: restore dhcp_domain in stable/4.0 (bsc#1145867)
• nova: add max_threads_per_process tuneable (SOC-10001, bsc#1133719)

grafana was updated to:

• CVE-2019-15043: Adds authentication to a few rest endpoints that could be used to access grafana snapshot apis to cause denial of service (SOC-10357 bsc#1148383) Also see https://github.com/grafana/grafana/compare/v5.4.4...v5.4.5

grafana was updated to version 4.6.5:

• CVE-2018-19039: Users with Editor or Admin permissions could exfiltrate files (jsc#SOC-9976 bsc#1115960)

grafana was updated version to 4.6.4:

• CVE-2018-15727 / CVE-2018-558213: Fixed an authentication bypass because an attacker can generate a valid 'remember me'cookie knowing only a username of an LDAP or OAuth user (jsc#SOC-9980 bsc#1106515)

Other fixes:

• sql: added code migration type
• release 4.6.3
• fix default alias
• fixes broken alert eval when first condition is using OR
• fix: alert list panel now works correctly after adding manual annotation on dashboard, fixes #9951
• fix: fix for avatar images when gzip is turned on, fixes #5952
• sets version to 4.6.2
• prom: add support for default step param (#9866)
• build: fixed jshint error
• fix: Html escaping caused issue in InfluxDB query editor, could not pick greater than or less then operators, fixes #9871
• heatmap: fix tooltip in 'Time series bucket' mode, #9332 (#9867)
• fix cloudwatch ec2_instance_attribute (#9718)
• colorpicker: fix color string change #9769 (#9780)
• changes version to 4.6.1
• fix: panel view now wraps, no scrolling required, fixes #9746
• plugins: fix for loading external plugins behind auth proxy, fixes #9509
• fix: color picker bug at series overrides page, #9715 (#9738)
• tech: switch to golang 1.9.2
• tech: add missing include
• save as should only delete threshold for panels with alerts
• fix: graphite annotation tooltip included undefined, fixes #9707
• build: updated version to v4.6.0
• plugins: added backward compatible path for rxjs
• ux: updated singlestat default colors
• prometheus: fixed unsaved changes warning when changing time range due to step option on query model was changed in datasource.query code, fixes #9675
• fix: firefox can now create region annotations, fixes #9638
• alerting: only editors can pause rules
• fix: another fix for playlist view state, #9639…

This update for ardana-ansible, ardana-glance, ardana-horizon, ardana-input-model, ardana-manila, ardana-neutron, ardana-nova, ardana-octavia, ardana-tempest, crowbar-core, crowbar-ha, crowbar-openstack, crowbar-ui, galera-3, grafana, mariadb, mariadb-connector-c, novnc, openstack-cinder, openstack-glance, openstack-heat, openstack-horizon-plugin-neutron-vpnaas-ui, openstack-keystone, openstack-monasca-installer, openstack-neutron, openstack-neutron-gbp, openstack-neutron-lbaas, openstack-nova, python-amqp, python-ovs, python-pysaml2, python-python-engineio, python-urllib3, release-notes-suse-openstack-cloud, rubygem-easy_diff, rubygem-rest-client-1_6, venv-openstack-keystone contains the following fixes:

• Update to version 8.0+git.1566374355.c509923:

  • Use raw image format when using SES backend on Nova (SOC-9285)

• Update to version 8.0+git.1566376789.be0fe01:

  • Configure glance image_direct_url/multiple_locations (SOC-9285)

• Update to version 8.0+git.1565816064.5d4f73f:

  • Removed None condition from rule (SOC-10003)

• Update to version 8.0+git.1566517401.98450e6:

  • Add neutron-fwaas.json when neutron-l3-agent is deployed (SOC-10280)

• Update to version 8.0+git.1568835837.2452e7a:

  • Ensure Manila services don't auto start on reboot (SOC-10641)

• Update to version 8.0+git.1568220097.74ee4b4:

  • API extension paths separated by colon (SOC-10447)

• Update to version 8.0+git.1567555448.5ecd5b0:

  • Add dependent services to neutron services (SOC-8746)

• Update to version 8.0+git.1566517377.f2a8c54:

  • Add policy.d/neutron-fwaas.json.j2 (SOC-10280)

• Update to version 8.0+git.1566902754.c58ff69:

  • Install libosinfo package (SOC-10295)

• Update to version 8.0+git.1565946419.a76c00e:

  • Set diskcachemode and disk discard when using RBD (SOC-10182)

• Update to version 8.0+git.1568373448.bcaee7e:

  • Make octavia heartbeat frequency options configurable (SOC-9285)

• Update to version 8.0+git.1566374572.a3c91d9:

  • Include SES variables when configuring image (SOC-9285)

• Update to version 8.0+git.1566208257.5213d93:

  • Use default values for amphora connection retries/timeout (SOC-9285)

• Update to version 8.0+git.1566471887.fd2fec7:

  • Delete existing run filter before deploying it (SOC-10287)

• Update to version 5.0+git.1569597589.1f025c557:

  • barclamp_lib: Sync timeout with other barclamps (SOC-10513, SOC-10011)

• Update to version 5.0+git.1569231378.ac645b753:

  • Revert 'batch: Use easy_merge for merging (SOC-10505)'

• Update to version 5.0+git.1569103607.ee4a6cbc9:

  • upgrade: Fix pie chart colors on dashboard (SOC-10619)

• Update to version 5.0+git.1568983947.70c39b8c7:

  • batch: Use easy_merge for merging (SOC-10505)

• Update to version 5.0+git.1568317972.dfb856def:

  • upgrade: Fix pre-checks tests (SOC-9868)
  • Allow designate rndc for all nodes (SOC-10339)

• Update to version 5.0+git.1568210854.4f87b86f8:

  • gems: Update easy_diff to 1.0.0 (SOC-10505)

• Update to version 5.0+git.1567531836.e06d68030:

  • Public ips for dns nodes when designate integration is in use (SOC-9635)

• Update to version 5.0+git.1567513044.e9ef28b03:

  • crowbar: Do not read /etc/crowbar.install.key in non-SUSE init script
  • transition.sh: Do not read /etc/crowbar.install.key
  • gather_logs: Make it a bit useful again
  • gather_logs: Do not read /etc/crowbar.install.key
  • network: Check existing upper layers before bond setup (bsc#1120657)
  • network: never plug two interface into the same ovs bridge (bsc#1120657)
  • network: Avoid plugging the same interface to two ovs bridges (bsc#1120657)
  • nic library: some helper for identifying base interface (bsc#1120657)
  • network: Rework the vlan port replugging code (bsc#1120657)
  • network: DRY out 'kill_nic_files' (noref)

• Update to version 5.0+git.1567161136.fa34ac9f2:

  • Add CVE-2019-5477 the to travis ignore list (SOC-9635)

• Update to version 5.0+git.1567094388.48f2be817:

  • upgrade: Add more prechecks for 8->9 (SOC-9868)

• Update…

This update for grafana to version 4.6.5 fixes the following issues:

Security issues fixed:

• CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383).
• CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960).
• CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515).
• CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985).
• CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862).

Non-security issue fixed:

• Solve wrongly categorized 'default.ini' file. (bsc#1167424) The configuration file was wrongly classified as documentation instead of configuration file. In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.