CVE-2020-24303

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.(CVE-2020-24303)

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-27846)

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.(CVE-2021-27358)

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.(CVE-2021-28148)

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.(CVE-2021-28147)

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to True (vs default of False), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.3.6). (BZ#1850471)

Security Fix(es):

• crewjam/saml: authentication bypass in saml authentication (CVE-2020-27846)

• grafana: XSS via a query alias for the Elasticsearch and Testdata datasource (CVE-2020-24303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.

Grafana before 7.1.0 allows XSS via a query alias for the ElasticSearch datasource.

Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/grafana/grafana before v7.1.0-beta1.

This update for crowbar-openstack, grafana, influxdb, python-urllib3 contains the following fixes:

Security fixes included in this update:

openstack-glance

• CVE-2016-8611: Added rate limiting for glance api (bnc#1005886)

grafana

• CVE-2020-24303: Fixed an XSS via a query alias for the ElasticSearch datasource (#bnc#1178243)

influxdb

• CVE-2019-20933: Fixed an authentication bypass (bnc#1178988)

python-urlib3

• CVE-2019-9740: Fixed a CRLF injection in urllib3 (bnc#1129071).
• CVE-2020-26137: Fixed a CRLF injection via HTTP request method (bnc#1177120)

memcached

• CVE-2018-1000115: Fixed a issue where a UDP server allowed spoofed traffic amplification DoS (bnc#1083903).

Non-security fixes included in this update:

Changes in crowbar-openstack:

• Update to version 4.0+git.1604938545.30c10db18:
  • rabbitmq: Fix crm running check (SOC-11240)

Changes in grafana:

• Fix bnc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch

Changes in influxdb:

• Add CVE-2019-20933.patch (bnc#1178988, CVE-2019-20933) to fix authentication bypass_

• Declare license files correctly

• Version 1.2.4:

  • The stress tool influx_stress will be removed in a subsequent release.
  • Remove the override of GOMAXPROCS.
  • Uncomment section headers from the default configuration file.
  • Improve write performance significantly.
  • Prune data in meta store for deleted shards.
  • Update latest dependencies with Godeps.
  • Introduce syntax for marking a partial response with chunking.
  • Use X-Forwarded-For IP address in HTTP logger if present.
  • Add support for secure transmission via collectd.
  • Switch logging to use structured logging everywhere.
  • [CLI feature request] USE retention policy for queries.
  • Add clear command to cli.
  • Adding ability to use parameters in queries in the v2 client using the Parameters map in the Query struct.
  • Allow add items to array config via ENV
  • Support subquery execution in the query language.
  • Verbose output for SSL connection errors.
  • Cache snapshotting performance improvements

• Partially revert previous change to fix build for Leap

Changes in python-urllib3:

• Update urllib3-fix-test-urls.patch. Adjust to match upstream solution.

• Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for CVE-2019-9740.

• Add urllib3-cve-2020-26137.patch. Don't allow control chars in request method. (bnc#1177120, CVE-2020-26137)

This update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark fixes the following issues:

Security changes included on this update:

grafana:

• CVE-2020-24303: Fixed an XXS with series overides. (bsc#1178243)

influxdb:

• CVE-2019-20933: Fixed an authentication bypass. (bsc#1178988)

python-Jinja2:

• CVE-2019-10906,CVE-2019-8341,CVE-2016-10745: 'SandboxedEnvironment' securely handles 'str.format_map' in order to prevent code execution through untrusted format strings. (bsc#1132323, bsc#1125815, bsc#1132174)

python-pysaml2:

• CVE-2020-5390: Fixed an issue where there was no check that the signature in a SAML document is enveloped. (bsc#1160851)

python-urllib3:

• CVE-2020-26137: Fixed a CRLF injection via HTTP request method. (bsc#1177120)

Non-security changes included in this update:

Changes in ardana-cassandra:

• Update to version 9.0+git.1600802664.7e480a2:
  • Remove freezer related backup/restore code (SOC-7751)

Changes in ardana-mq:

• Update to version 9.0+git.1605174486.a78ddce:
  • Re-enable mirroring of fanout and reply queues (bsc#1177611)

Changes in ardana-osconfig:

• Update to version 9.0+git.1601621747.a87e5a0:
  • HOS8 check needs to be a shell rather than command (SOC-11184)

Changes in ardana-tempest:

• Update to version 9.0+git.1603378983.fc0bca9:

  • Enable VPNaaS testing (SOC-8764)

• Update to version 9.0+git.1599855218.875b2f3:

  • unblacklist some revert tests (SOC-9178)

Changes in crowbar-core:

• Update to version 6.0+git.1606314264.bf9ada813:

  • ntp: Do not use rate-limiting (bsc#1179161)

• Update to version 6.0+git.1600414599.150832ca2:

  • Ignore CVE-2020-15169 (SOC-11391)

Changes in crowbar-openstack:

• Update to version 6.0+git.1604573541.bb18c172d:

  • rabbitmq: Fix crm running check (SOC-11240)

• Update to version 6.0+git.1604491402.b4dbba849:

  • Remove aspiers from CODEOWNERS
  • Remove cmurphy from CODEOWNERS

Changes in grafana:

• Fix bsc#1178243 CVE-2020-24303 by adding 25401-Fix-XSS-vulnerability-with-series-overrides.patch

Changes in influxdb:

• Add CVE-2019-20933.patch (bsc#1178988, CVE-2019-20933) to fix authentication bypass
• Declare license files correctly

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-cinder:

• Update to version cinder-13.0.10.dev20:

  • PowerMax Driver - Legacy volumes fail to live migrate

• Update to version cinder-13.0.10.dev19:

  • RBD: Cleanup temporary file during exception

• Update to version cinder-13.0.10.dev17:

  • Remove experimental job legacy-tempest-dsvm-zeromq-multibackend

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat:

• Update to version openstack-heat-11.0.4.dev4:

  • Check external resources after creation

• Update to version openstack-heat-11.0.4.dev2:

  • Don't store signal_url for ec2 signaling of deployments
  • Allow scale-down of ASG as part of update 11.0.3

Changes in openstack-heat-gbp:

• Update to version group-based-policy-automation-12.0.1.dev2:

  • Add support for victoria

• Update to version group-based-policy-automation-12.0.1.dev1: *…

This update for grafana and system-user-grafana fixes the following issues:

• Updated grafana to upstream version 7.3.1

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana

  • CVE-2020-12245: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip (bsc#1170557)

  • CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault (bsc#1172409)

  • CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana (bsc#1148383)

  • CVE-2020-12052: Grafana version below 6.7.3 is vulnerable for annotation popup XSS (bsc#1170657)

  • CVE-2020-24303: Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. (bsc#1178243)

  • CVE-2018-18623: Grafana 5.3.1 has XSS via the 'Dashboard > Text Panel' screen (bsc#1172450)

  • CVE-2019-19499: Grafana versions below or equal to 6.4.3 has an Arbitrary File Read vulnerability, which could be exploited by an authenticated attacker that has privileges to modify the data source configurations (bsc#1175951)

  • Please refer to this package's changelog to get a full list of all changes (including bug fixes etc.)

• Initial shipment of system-user-grafana to SES 6

This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:

Security fixes included in this update:

cassandra:

• CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced correctly for certain internode_encryption settings (bsc#1181689)

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross site scripting vulnerabilities in the dashboard. (bsc#1172450)
• CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)
• CVE-2019-15043: Fixed a denial of service by an unauthenticated user in the snapshot HTTP API (bsc#1148383)
• CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)
• CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation popup (bsc#1170657)
• CVE-2018-19039: Fixed an issue where a privileged user could exfiltrate files (bsc#1115960)
• CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)
• CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for ElasticSearch datasources (bsc#1178243)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service. (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields. (bsc#1044849)
• CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used by default. (bsc#1171909)

python-Django:

• CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl(). (bsc#1182433)
• CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names. (bsc#1185623)
• CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView. (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks. (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)

python-pysaml2:

• CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed SAML documents. (bsc#1181277)
• CVE-2021-21239: Fixed improper verification of cryptographic signatures when using CryptoBackendXmlSec1(). (bsc#1181278)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions. (bsc#1183174)

Non-security changes included in this update:

Changes in ardana-neutron:

• Update to version 9.0+git.1615223676.777f0b3:
  • Allow users to stop monitoring rootwrap daemon (bsc#1182317)

Changes in ardana-swift:

• Update to version 9.0+git.1618235096.90974ed:
  • Run swiftlm-scan in the UTC timezone (bsc#1181690)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary…