CVE-2021-41244

Impact

On Nov. 2, during an internal security audit, we discovered that when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance, Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin.

Patches

Fixed in 8.2.4

Workarounds

All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag.

Grafana Cloud instances have not been affected by the vulnerability.

Reporting security issues

If you think you have found a security vulnerability, please send a report to [email protected]. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

Security announcements

We maintain a security category on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our RSS feed.

Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role. All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag.

Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled and there is more than one organization in the Grafana instance admins are able to access users from other organizations. Grafana 8.0 introduced a mechanism which allowed users with the Organization Admin role to list, add, remove, and update users’ roles in other organizations in which they are not an admin. With fine-grained access control enabled, organization admins can list, add, remove and update users' roles in another organization, where they do not have organization admin role. All installations between v8.0 and v8.2.3 that have fine-grained access control beta enabled and more than one organization should be upgraded as soon as possible. If you cannot upgrade, you should turn off the fine-grained access control using a feature flag.

These are all security issues fixed in the grafana-8.3.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23422)

• Security:

  • CVE-2022-21702: XSS vulnerability in handling data sources (bsc#1195726)
  • CVE-2022-21703: cross-origin request forgery vulnerability (bsc#1195727)
  • CVE-2022-21713: Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728)
  • CVE-2022-21673: GetUserInfo: return an error if no user was found (bsc#1194873)
  • CVE-2021-43813, CVE-2021-43815, CVE-2021-41244, CVE-2021-41174, CVE-2021-43798, CVE-2021-39226.
  • Upgrade Docker base image to Alpine 3.14.3.
  • CVE-2021-3711: Docker: Force use of libcrypto1.1 and libssl1.1 versions
  • Update dependencies to fix CVE-2021-36222.
  • Upgrade Go to 1.17.2.
  • Fix stylesheet injection vulnerability.
  • Fix short URL vulnerability.

• License update:

  • AGPL License: Update license from Apache 2.0 to the GNU Affero General Public License (AGPL).

• Breaking changes:

  • Grafana 8 Alerting enabled by default for installations that do not use legacy alerting.
  • Keep Last State for 'If execution error or timeout' when upgrading to Grafana 8 alerting.
  • Fix No Data behaviour in Legacy Alerting.
  • The following endpoints were deprecated for Grafana v5.0 and support for them has now been removed:
    • GET /dashboards/db/:slug
    • GET /dashboard-solo/db/:slug
    • GET /api/dashboard/db/:slug
    • DELETE /api/dashboards/db/:slug
  • The default HTTP method for Prometheus data source is now POST.
  • Removes the never refresh option for Query variables.
  • Removes the experimental Tags feature for Variables.

• Deprecations:

  • The InfoBox & FeatureInfoBox are now deprecated please use the Alert component instead with severity info.

• Bug fixes:

  • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
  • Azure Monitor: Improved error messages for variable queries.
  • CloudMonitoring: Fixes broken variable queries that use group bys.
  • Configuration: You can now see your expired API keys if you have no active ones.
  • Elasticsearch: Fix handling multiple datalinks for a single field.
  • Export: Fix error when exporting dashboards using query variables that reference the default datasource.
  • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
  • Login: Page no longer overflows on mobile.
  • Plugins: Set backend metadata property for core plugins.
  • Prometheus: Fill missing steps with null values.
  • Prometheus: Fix interpolation of $__rate_interval variable.
  • Prometheus: Interpolate variables with curly brackets syntax.
  • Prometheus: Respect the http-method data source setting.
  • Table: Fixes issue with field config applied to wrong fields when hiding columns.
  • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
  • Variables: Fix so data source variables are added to adhoc configuration.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix…

This security update fixes the following issues:

golang-github-prometheus-prometheus:

• Upgrade to upstream version 2.32.1 (jsc#SLE-22863)
  • Bugfixes:
    • Scrape: Fix reporting metrics when sample limit is reached during the report. #9996
    • Scrape: Ensure that scrape interval and scrape timeout are always set. #10023
    • TSDB: Expose and fix bug in iterators' Seek() method. #10030
• Upgrade to upstream version 2.32.0
  • Change:
    • remote-write: Change default max retry time from 100ms to 5 seconds. #9634
  • Features:
    • Agent: New mode of operation optimized for remote-write only scenarios, without local storage.
    • Promtool: Add promtool check service-discovery command. #8970
  • Enhancements:
    • Promtool: Improve test output. #8064
    • Promtool: Use kahan summation for better numerical stability.
    • Remote-write: Reuse memory for marshalling. #9412
    • Scrape: Add scrape_body_size_bytes scrape metric behind the --enable-feature=extra-scrape-metrics flag. #9569
    • TSDB: Add windows arm64 support. #9703
    • TSDB: Optimize query by skipping unneeded sorting in TSDB.
    • Templates: Support int and uint as datatypes for template formatting. #9680
    • UI: Prefer rate over rad, delta over deg, and count over cos in autocomplete. #9688
    • TSDB: Add more size checks when writing individual sections in the index. #9710
    • PromQL: Make deriv() return zero values for constant series.
    • TSDB: Fix panic when checkpoint directory is empty. #9687
    • TSDB: Fix panic, out of order chunks, and race warning during WAL replay. #9856
    • UI: Correctly render links for targets with IPv6 addresses that contain a Zone ID. #9853
    • Promtool: Fix checking of authorization.credentials_file and bearer_token_file fields. #9883
    • Uyuni SD: Fix null pointer exception during initialization.
    • TSDB: Fix queries after a failed snapshot replay. #9980
• Upgrade to upstream version 2.31.1
  • Bugfix:
    • SD: Fix a panic when the experimental discovery manager receives targets during a reload. #9656
• Upgrade to upstream version 2.31.0
  • UI: Remove standard PromQL editor in favour of the codemirror-based editor. #9452
  • PromQL: Add trigonometric functions and atan2 binary operator. #9239 #9248 #9515
  • Remote: Add support for exemplar in the remote write receiver endpoint. #9319 #9414
  • SD: Add PuppetDB service discovery. #8883
  • SD: Add Uyuni service discovery. #8190
  • Web: Add support for security-related HTTP headers. #9546
  • Azure SD: Add proxy_url, follow_redirects, tls_config. #9267
  • Backfill: Add --max-block-duration in promtool create-blocks-from rules. #9511
  • Config: Print human-readable sizes with unit instead of raw numbers. #9361
  • HTTP: Re-enable HTTP/2. #9398
  • Kubernetes SD: Warn user if number of endpoints exceeds limit. #9467
  • OAuth2: Add TLS configuration to token requests. #9550
  • PromQL: Several optimizations. #9365 #9360 #9362 #9552
  • PromQL: Make aggregations deterministic in instant queries.
  • Rules: Add the ability to limit number of alerts or series.
  • SD: Experimental discovery manager to avoid restarts upon reload.
  • UI: Debounce timerange setting changes. #9359
  • Backfill: Apply rule labels after query labels. #9421
  • Scrape: Resolve conflicts between multiple exported label prefixes. #9479 #9518
  • Scrape: Restart scrape loops when scrape_interval is changed. #9551
  • TSDB: Fix memory leak in samples deletion. #9151
  • UI: Use consistent margin-bottom for all alert kinds. #9318
• Upgrade to upstream version 2.30.3
  • TSDB: Fix panic on failed snapshot replay. #9438
  • TSDB: Don't fail snapshot replay with exemplar storage disabled when the snapshot contains exemplars. #9438
• Upgrade to upstream version 2.30.2
  • TSDB: Don't error on…

This update fixes the following issues:

grafana:

• Update from version 7.5.12 to version 8.3.5 (jsc#SLE-23439, jsc#SLE-23422)
  • Security:
    • Fixes XSS vulnerability in handling data sources (bsc#1195726, CVE-2022-21702)
    • Fixes cross-origin request forgery vulnerability (bsc#1195727, CVE-2022-21703)
    • Fixes Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728, CVE-2022-21713)
• Update to Go 1.17.
• Add build-time dependency on wire.
• Update license to GNU Affero General Public License v3.0.
• Update to version 8.3.4
  • GetUserInfo: return an error if no user was found (bsc#1194873, CVE-2022-21673)
  • Features and enhancements:
    • Alerting: Allow configuration of non-ready alertmanagers.
    • Alerting: Allow customization of Google chat message.
    • AppPlugins: Support app plugins with only default nav.
    • InfluxDB: query editor: skip fields in metadata queries.
    • Postgres/MySQL/MSSQL: Cancel in-flight SQL query if user cancels query in grafana.
    • Prometheus: Forward oauth tokens after prometheus datasource migration.
  • Bug fixes:
    • Azure Monitor: Bug fix for variable interpolations in metrics dropdowns.
    • Azure Monitor: Improved error messages for variable queries.
    • CloudMonitoring: Fixes broken variable queries that use group bys.
    • Configuration: You can now see your expired API keys if you have no active ones.
    • Elasticsearch: Fix handling multiple datalinks for a single field.
    • Export: Fix error being thrown when exporting dashboards using query variables that reference the default datasource.
    • ImportDashboard: Fixes issue with importing dashboard and name ending up in uid.
    • Login: Page no longer overflows on mobile.
    • Plugins: Set backend metadata property for core plugins.
    • Prometheus: Fill missing steps with null values.
    • Prometheus: Fix interpolation of $__rate_interval variable.
    • Prometheus: Interpolate variables with curly brackets syntax.
    • Prometheus: Respect the http-method data source setting.
    • Table: Fixes issue with field config applied to wrong fields when hiding columns.
    • Toolkit: Fix bug with rootUrls not being properly parsed when signing a private plugin.
    • Variables: Fix so data source variables are added to adhoc configuration.
  • Plugin development fixes & changes:
    • Toolkit: Revert build config so tslib is bundled with plugins to prevent plugins from crashing.
• Update to version 8.3.3:
  • BarChart: Use new data error view component to show actions in panel edit.
  • CloudMonitor: Iterate over pageToken for resources.
  • Macaron: Prevent WriteHeader invalid HTTP status code panic.
  • AnnoListPanel: Fix interpolation of variables in tags.
  • CloudWatch: Allow queries to have no dimensions specified.
  • CloudWatch: Fix broken queries for users migrating from 8.2.4/8.2.5 to 8.3.0.
  • CloudWatch: Make sure MatchExact flag gets the right value.
  • Dashboards: Fix so that empty folders can be deleted from the manage dashboards/folders page.
  • InfluxDB: Improve handling of metadata query errors in InfluxQL.
  • Loki: Fix adding of ad hoc filters for queries with parser and line_format expressions.
  • Prometheus: Fix running of exemplar queries for non-histogram metrics.
  • Prometheus: Interpolate template variables in interval.
  • StateTimeline: Fix toolitp not showing when for frames with multiple fields.
  • TraceView: Fix virtualized scrolling when trace view is opened in right pane in Explore.
  • Variables: Fix repeating panels for on time range changed variables.
  • Variables: Fix so queryparam option works for scoped
• Update to version 8.3.2
  • Security: Fixes CVE-2021-43813 and CVE-2021-43815.
• Update to version 8.3.1
  • Security: Fixes CVE-2021-43798.
• Update to version…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-prometheus-alertmanager:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24077)
• Update required Go version to 1.16
• Update to version 0.23.0:
  • amtool: Detect version drift and warn users (#2672)
  • Add ability to skip TLS verification for amtool (#2663)
  • Fix empty isEqual in amtool. (#2668)
  • Fix main tests (#2670)
  • cli: add new template render command (#2538)
  • OpsGenie: refer to alert instead of incident (#2609)
  • Docs: target_match and source_match are DEPRECATED (#2665)
  • Fix test not waiting for cluster member to be ready
• Added hardening to systemd service(s) (bsc#1181400)

golang-github-prometheus-node_exporter:

• CVE-2022-21698: Denial of service using InstrumentHandlerCounter.
  • Update vendor tarball with prometheus/client_golang 1.11.1 (bsc#1196338, jsc#SLE-24238, jsc#SLE-24239)
• Update to 1.3.0
  • [CHANGE] Add path label to rapl collector #2146
  • [CHANGE] Exclude filesystems under /run/credentials #2157
  • [CHANGE] Add TCPTimeouts to netstat default filter #2189
  • [FEATURE] Add lnstat collector for metrics from /proc/net/stat/ #1771
  • [FEATURE] Add darwin powersupply collector #1777
  • [FEATURE] Add support for monitoring GPUs on Linux #1998
  • [FEATURE] Add Darwin thermal collector #2032
  • [FEATURE] Add os release collector #2094
  • [FEATURE] Add netdev.address-info collector #2105
  • [FEATURE] Add clocksource metrics to time collector #2197
  • [ENHANCEMENT] Support glob textfile collector directories #1985
  • [ENHANCEMENT] ethtool: Expose node_ethtool_info metric #2080
  • [ENHANCEMENT] Use include/exclude flags for ethtool filtering #2165
  • [ENHANCEMENT] Add flag to disable guest CPU metrics #2123
  • [ENHANCEMENT] Add DMI collector #2131
  • [ENHANCEMENT] Add threads metrics to processes collector #2164
  • [ENHANCMMENT] Reduce timer GC delays in the Linux filesystem collector #2169
  • [ENHANCMMENT] Add TCPTimeouts to netstat default filter #2189
  • [ENHANCMMENT] Use SysctlTimeval for boottime collector on BSD #2208
  • [BUGFIX] ethtool: Sanitize metric names #2093
  • [BUGFIX] Fix ethtool collector for multiple interfaces #2126
  • [BUGFIX] Fix possible panic on macOS #2133
  • [BUGFIX] Collect flag_info and bug_info only for one core #2156
  • [BUGFIX] Prevent duplicate ethtool metric names #2187
• Update to 1.2.2
  • Bug fixes Fix processes collector long int parsing #2112
• Update to 1.2.1
  • Removed Remove obsolete capture permission denied error patch that is already included upstream Fix zoneinfo parsing prometheus/procfs#386 Fix nvme collector log noise #2091 Fix rapl collector log noise #2092
• Update to 1.2.0
  • Changes Rename filesystem collector flags to match other collectors #2012 Make node_exporter print usage to STDOUT #203
  • Features Add conntrack statistics metrics #1155 Add ethtool stats collector #1832 Add flag to ignore network speed if it is unknown #1989 Add tapestats collector for Linux #2044 Add nvme collector #2062
  • Enhancements Add ErrorLog plumbing to promhttp #1887 Add more Infiniband counters #2019 netclass: retrieve interface names and filter before parsing #2033 Add time zone offset metric #2060 Handle errors from disabled PSI subsystem #1983 Fix panic when using backwards compatible flags #2000 Fix wrong value for OpenBSD memory buffer cache #2015 Only initiate collectors once #2048 Handle small backwards jumps in CPU idle #2067
• Apply patch to capture permission denied error for 'energy_uj' file (bsc#1190535)

grafana:

• Update to…

This update for grafana fixes the following issues:

Updated to version 8.5.13 (jsc#PED-2145, jsc#SLE-23439, jsc#SLE-23422, jsc#SLE-24565):

• CVE-2022-36062: Fixed RBAC folders/dashboards privilege escalation (bsc#1203596).
• CVE-2022-35957: Fixed escalation from admin to server admin when auth proxy is used (bsc#1203597).
• CVE-2022-31107: Fixed OAuth account takeover (bsc#1201539).
• CVE-2022-31097: Fixed XSS vulnerability in the Unified Alerting (bsc#1201535).
• CVE-2022-21702: Fixed XSS vulnerability in handling data sources (bsc#1195726).
• CVE-2022-21703: Fixed cross-origin request forgery vulnerability (bsc#1195727).
• CVE-2022-21713: Fixed Insecure Direct Object Reference vulnerability in Teams API (bsc#1195728).
• CVE-2022-21673: Fixed missing error return in GetUserInfo if no user was found (bsc#1194873).
• CVE-2021-43815: Fixed directory traversal for .csv files (bsc#1193686).
• CVE-2021-41244: Fixed incorrect access control vulnerability(bsc#1192763).
• CVE-2021-41174: Fixed XSS vulnerability on unauthenticated pages through interpolation binding expressions for AngularJS in URL (bsc#1192383).
• CVE-2021-3711: Fixed SM2 Decryption Buffer Overflow (bsc#1189520).
• CVE-2021-36222: Fixed a null pointer dereference in the KDC (bsc#1188571).
• CVE-2021-43798: Fixed arbitrary file read in the graph native plugin (bsc#1193492).

This update for grafana fixes the following issues:

Version update from 8.3.10 to 8.5.13 (jsc#PED-2145):

• Security fixes:

  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)

• Features and enhancements:

  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to api/ds/query
  • Rendering: Add support for renderer token
  • Setting: Support configuring feature toggles…

This update fixes the following issues:

dracut-saltboot:

• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8.

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins …

This update fixes the following issues:

golang-github-boynux-squid_exporter:

• Exclude s390 architecture
• Enhanced to build on Enterprise Linux 8

grafana:

• Version update from 8.3.10 to 8.5.13 (jsc#PED-2145)
• Security fixes:
  • CVE-2022-36062: (bsc#1203596)
  • CVE-2022-35957: (bsc#1203597)
  • CVE-2022-31107: (bsc#1201539)
  • CVE-2022-31097: (bsc#1201535)
  • CVE-2022-29170: (bsc#1199810)
  • CVE-2021-43813, CVE-2021-43815: (bsc#1193686)
  • CVE-2021-43798: (bsc#1193492)
  • CVE-2021-41244: (bsc#1192763)
  • CVE-2021-41174: (bsc#1192383)
  • CVE-2021-3711: (bsc#1189520)
  • CVE-2021-36222: (bsc#1188571)
• Features and enhancements:
  • AccessControl: Disable user remove and user update roles when they do not have the permissions
  • AccessControl: Provisioning for teams
  • Alerting: Add custom grouping to Alert Panel
  • Alerting: Add safeguard for migrations that might cause dataloss
  • Alerting: AlertingProxy to elevate permissions for request forwarded to data proxy when RBAC enabled
  • Alerting: Grafana uses > instead of >= when checking the For duration
  • Alerting: Move slow queries in the scheduler to another goroutine
  • Alerting: Remove disabled flag for data source when migrating alerts
  • Alerting: Show notification tab of legacy alerting only to editor
  • Alerting: Update migration to migrate only alerts that belon to existing org\dashboard
  • Alerting: Use expanded labels in dashboard annotations
  • Alerting: Use time.Ticker instead of alerting.Ticker in ngalert
  • Analytics: Add user id tracking to google analytics
  • Angular: Add AngularJS plugin support deprecation plan to docs site
  • API: Add usage stats preview endpoint
  • API: Extract OpenAPI specification from source code using go-swagger
  • Auth: implement auto_sign_up for auth.jwt
  • Azure monitor Logs: Optimize data fetching in resource picker
  • Azure Monitor Logs: Order subscriptions in resource picker by name
  • Azure Monitor: Include datasource ref when interpolating variables.
  • AzureMonitor: Add support for not equals and startsWith operators when creating Azure Metrics dimension filters.
  • AzureMonitor: Do not quote variables when a custom 'All' variable option is used
  • AzureMonitor: Filter list of resources by resourceType
  • AzureMonitor: Update allowed namespaces
  • BarChart: color by field, x time field, bar radius, label skipping
  • Chore: Implement OpenTelemetry in Grafana
  • Cloud Monitoring: Adds metric type to Metric drop down options
  • CloudMonitor: Correctly encode default project response
  • CloudWatch: Add all ElastiCache Redis Metrics
  • CloudWatch: Add Data Lifecycle Manager metrics and dimension
  • CloudWatch: Add Missing Elasticache Host-level metrics
  • CloudWatch: Add multi-value template variable support for log group names in logs query builder
  • CloudWatch: Add new AWS/ES metrics. #43034, @sunker
  • Cloudwatch: Add support for AWS/PrivateLink* metrics and dimensions
  • Cloudwatch: Add support for new AWS/RDS EBS* metrics
  • Cloudwatch: Add syntax highlighting and autocomplete for 'Metric Search'
  • Cloudwatch: Add template variable query function for listing log groups
  • Configuration: Add ability to customize okta login button name and icon
  • Elasticsearch: Add deprecation notice for < 7.10 versions.
  • Explore: Support custom display label for exemplar links for Prometheus datasource
  • Hotkeys: Make time range absolute/permanent
  • InfluxDB: Use backend for influxDB by default via feature toggle
  • Legend: Use correct unit for percent and count calculations
  • Logs: Escape windows newline into single newline
  • Loki: Add unpack to autocomplete suggestions
  • Loki: Use millisecond steps in Grafana 8.5.x.
  • Playlists: Enable sharing direct links to playlists
  • Plugins: Allow using both Function and Class components for app plugins
  • Plugins: Expose emotion/react to plugins to prevent load failures
  • Plugins: Introduce HTTP 207 Multi Status response to…

This update fixes the following issues:

golang-github-QubitProducts-exporter_exporter:

• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Fix apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build using promu
• Fix sandboxing options
• Upgrade to version 0.13.4
  • CVE-2022-32149: Fix denial of service vulnerability (bsc#1204501)
• Upgrade to version 0.13.3
  • CVE-2022-41723: Fix uncontrolled resource consumption (bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • CVE-2022-46146: Fix authentication bypass vulnarability (bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-alertmanager:

• Do not create PIE for s390x architecture
• Require Go 1.20 or newer for building
• Remove not used build flags
• Create position independent executables (PIE)
• Disable striping the binaries only for SLE 15 SP3
• Add System/Monitoring group tag
• Rework service file to use obscpio
  • Run tar and recompress services at buildtime
  • Do not generate automatically changelog entries
• Update to version 0.26.0 (jsc#PED-7353): https://github.com/prometheus/alertmanager/releases/tag/v0.26.0
  • CVE-2023-40577: Fix stored XSS via the /api/v1/alerts endpoint in the Alertmanager UI (bsc#1218838)
  • Configuration: Fix empty list of receivers and inhibit_rules would cause the alertmanager to crash
  • Templating: Fixed a race condition when using the title function. It is now race-safe
  • API: Fixed duplicate receiver names in the api/v2/receivers API endpoint
  • API: Attempting to delete a silence now returns the correct status code, 404 instead of 500
  • Clustering: Fixes a panic when tls_client_config is empty
  • Webhook: url is now marked as a secret. It will no longer show up in the logs as clear-text
  • Metrics: New label reason for alertmanager_notifications_failed_total metric to indicate the type of error of the alert delivery
  • Clustering: New flag --cluster.label, to help to block any traffic that is not meant for the cluster
  • Integrations: Add Microsoft Teams as a supported integration
• Update to version 0.25.0: https://github.com/prometheus/alertmanager/releases/tag/v0.25.0
  • Fail configuration loading if api_key and api_key_file are defined at the same time
  • Fix the alertmanager_alerts metric to avoid counting resolved alerts as active. Also added a new alertmanager_marked_alerts metric that retain the old behavior
  • Trim contents of Slack API URLs when reading from files
  • amtool: Avoid panic when the label value matcher is empty
  • Fail configuration…

This update fixes the following issues:

ansible:

• Update to version 2.9.27 (jsc#SLE-23631) (jsc#SLE-24133)
  • bsc#1187725 CVE-2021-3620 ansible-connection module discloses sensitive info in traceback error message (in 2.9.27)
  • bsc#1188061 CVE-2021-3583 Template Injection through yaml multi-line strings with ansible facts used in template. (in 2.9.23)
  • bsc#1176460 gh#ansible/ansible#72094 ansible module nmcli is broken in ansible 2.9.13 (in 2.9.15)
• Update to 2.9.22:
  • CVE-2021-3447 (bsc#1183684) multiple modules expose secured values
  • CVE-2021-20228 (bsc#1181935) basic.py no_log with fallback option
  • CVE-2021-20191 (bsc#1181119) multiple collections exposes secured values
  • CVE-2021-20180 (bsc#1180942) bitbucket_pipeline_variable exposes sensitive values
  • CVE-2021-20178 (bsc#1180816) user data leak in snmp_facts module

dracut-saltboot:

• Update to version 0.1.1681904360.84ef141
  • Load network configuration even when missing protocol version (bsc#1210640)
• Update to verion 0.1.1674034019.a93ff61
  • Install copied wicked config as client.xml (bsc#1205599)
• Update to version 0.1.1673279145.e7616bd
  • Add failsafe stop file when salt-minion does not stop (bsc#1172110)
  • Copy existing wicked config instead of generating new (bsc#1205599)
• Update to version 0.1.1665997480.587fa10
  • Add dependencies on xz and gzip to support compressed images
• Update to version 0.1.1661440542.6cbe0da
  • Use standard susemanager.conf
  • Move image services to dracut-saltboot package
  • Use salt bundle
• Require e2fsprogs (bsc#1202614)
• Update to version 0.1.1657643023.0d694ce
  • Update dracut-saltboot dependencies (bsc#1200970)
  • Fix network loading when ipappend is used in pxe config
  • Add new information messages

golang-github-QubitProducts-exporter_exporter:

• Remove license file from %doc
• Exclude s390 arch
• Adapted to build on Enterprise Linux.
• Fix build for RedHat 7
• Require Go >= 1.14 also for CentOS
• Add support for CentOS
• Replace %{?systemd_requires} with %{?systemd_ordering}

golang-github-boynux-squid_exporter:

• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Enhanced to build on Enterprise Linux 8.

golang-github-lusitaniae-apache_exporter:

• Do not strip if SUSE Linux Enterprise 15 SP3
• Exclude debug for RHEL >= 8
• Build with Go >= 1.20 when the OS is not RHEL
• Spec file clean up
• Fix apparmor profile for SLE 12
• Do not build with apparmor profile for SLE 12
• Upgrade to version 1.0.0 (jsc#PED-5405)
  • Improved flag parsing
  • Added support for custom headers
• Build with Go 1.19
• Build using promu
• Add _service file
• Fix sandboxing options
• Upgrade to version 0.13.4
  • Fix denial of service vulnerability (CVE-2022-32149, bsc#1204501)
• Upgrade to version 0.13.3
  • Fix uncontrolled resource consumption (CVE-2022-41723, bsc#1208270)
• Upgrade to version 0.13.1
  • Fix panic caused by missing flagConfig options
• Upgrade to version 0.13.0
  • Fix authentication bypass vulnarability (CVE-2022-46146, bsc#1208046)
• Corrected comment in AppArmor profile
• Added AppArmor profile
• Added sandboxing options to systemd service unit
• Exclude s390 architecture (gh#SUSE/spacewalk#19050)
• Update to upstream release 0.11.0 (jsc#SLE-24791)
  • Add TLS support
  • Switch to logger, please check --log.level and --log.format flags
• Update to version 0.10.1
  • Bugfix: Reset ProxyBalancer metrics on each scrape to remove stale data
• Update to version 0.10.0
  • Add Apache Proxy and other metrics
• Update to version 0.8.0
  • Change commandline flags
  • Add metrics: Apache version, request duration total
• Adapted to build on Enterprise Linux 8
• Require building with Go 1.15
• Add support for RedHat 8
  • Adjust dependencies on spec file
  • Disable dwarf compression in go build
• Add support for Red Hat
• Add %license macro for LICENSE file

golang-github-prometheus-prometheus:

• Update to 2.45.0 (jsc#PED-5406):
  • [FEATURE] API:…