CVE-2025-2703

These are all security issues fixed in the grafana-11.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for grafana fixes the following issues:

Changes in grafana:

• Update to version 11.6.11: Features and enhancements:

  • Alerting: Add limits for the size of expanded notification templates
  • Correlations: Remove support for org_id=0 Security:
  • CVE-2026-21722: Public dashboards annotations: use dashboard timerange if time selection disabled (bsc#1258136)

• Update to version 11.6.10: Features and enhancements:

  • API: Add missing scope check on dashboards
  • Avatar: Require sign-in, remove queue, respect timeout Bug fixes:
  • Alerting: Fix a race condition panic in ResetStateByRuleUID

• Update to version 11.6.9: Features and enhancements:

  • Plugins: Add PluginContext to plugins when scenes is disabled Bug fixes:
  • Alerting: Fix contacts point issues

• Update to version 11.6.8: Bug fixes:

  • Alerting: Fix unmarshalling of GettableStatus to include time intervals

• Update to version 11.6.7: Bug fixes:

  • Auth: Fix render user OAuth passthrough
  • LDAP Authentication: Fix URL to propagate username context as parameter
  • Plugins: Dependencies do not inherit parent URL for preinstall
  • URLParams: Stringify true values as key=true always (fixes issues with variables with true value)

• Update to version 11.6.6: Bug fixes:

  • Alerting: Fix copying of recording rule fields
  • Fix redirection after login when Grafana is served from subpath

• Update to version 11.6.5: Features and enhancements:

  • Alerting: Bump alerting package to include change to NewTLSClient

• Update to version 11.6.4: Features and enhancements:

  • StateTimeline: Add endTime to tooltip
  • Unified storage: Respect GF_DATABASE_URL override Bug fixes:
  • Alerting: Fix group interval override when adding new rules
  • Azure: Fix legend formatting
  • Azure: Fix resource name determination in template variable queries
  • Graphite: Fix annotation queries
  • Graphite: Fix date mutation
  • Graphite: Fix nested variable interpolation for repeated rows

• Update to version 11.6.3: Security:

  • Fixes CVE-2025-3415

• Update to version 11.6.2: Bug fixes:

  • Dashboard: Fixes issue with row repeats and first row
  • Graphite: Ensure template variables are interpolated correctly
  • Graphite: Fix Graphite series interpolation
  • Prometheus: Fix semver import path

• Update to version 11.6.1: Features and enhancements:

  • DashboardScenePage: Correct slug in self referencing data links
  • GrafanaUI: Use safePolygon close handler for interactive tooltips instead of a delay
  • Prometheus: Add support for cloud partners Prometheus data sources Bug fixes:
  • Alertmanager: Add Role-Based Access Control via reqAction Field
  • GrafanaUI: Remove blurred background from overlay backdrops to improve performance
  • InfluxDB: Fix nested variable interpolation
  • LDAP test: Fix page crash
  • Org redirection: Fix linking between orgs

• Upgrade to version 11.6.0: Features and enhancements:

  • Visualisations: One click links and actions
  • Annotations: Add cron syntax support
  • WebGL-powered geomaps for better performance
  • Alerting: Add alert rule version history Security:
  • API keys: Migrate API keys to service accounts at startup

• CVE-2026-21721: Fix access control by the dashboard permissions API (bsc#1257337)

• CVE-2026-21720: Fix unauthenticated DoS (bsc#1257349)

• CVE-2025-68156: Fix potential DoS via unbounded recursion in builtin functions (bsc#1255340)

• CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (bsc#1254113)

• Use forked wire from Grafana repository instead of external package (jsc#PED-14178).

• Update to version 11.5.10: Security:

  • CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
  • CVE-2025-58190: Fix excessive memory consumption (bsc#1251657) Features and enhancements:
  • Update to Go 1.25
  • Update to golang.org/x/net v0.45.0 Bug fixes:
  • Auth: Fix render user OAuth…

This update fixes the following issues:

release-notes-susemanager:

• Update to SUSE Manager 4.3.15.2
  • SUSE Manager 4.3 will transition to LTS after June 2025
  • CVE Fixed CVE-2023-45288, CVE-2024-11741, CVE-2024-45337, CVE-2024-45339 CVE-2024-51744, CVE-2024-9264, CVE-2024-9476, CVE-2025-22870 CVE-2025-22872, CVE-2025-2703 CVE-2025-27144, CVE-2025-3454 CVE-2025-3580, CVE-2025-4123, CVE-2024-47535

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

• Security issues fixed:

  • CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
  • CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

• Other bugs fixes from version 2.53.4:

  • Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage
  • Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

• Security issues fixed:

  • CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
  • CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

• Other changes from version 0.26.0:

  • Changes:
    • Replace go-kit/log with log/slog module.
  • Features:
    • Add metric to record tls ciphersuite negotiated during handshake.
    • Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
  • Enhancement:
    • Add stale workflow to start sync with stale.yaml in Prometheus.
  • Bug fixes:
    • Only register grpc TLS metrics on successful handshake.

• Other changes from version 0.25.0:

  • Features:
    • Allow to get Probe logs by target.
    • Log errors from probe.
  • Bug fixes:
    • Prevent logging confusing error message.
    • Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

• Security issues fixed:

  • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
  • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
  • CVE-2024-9264: SQL Expressions (bsc#1231844)
  • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

• Potential breaking changes in version 11.5.0:

  • Loki: Default to /labels API with query param instead of /series API.

• Potential breaking changes in version 11.0.1:

  • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

• Potential breaking changes in version 11.0.0:

  • AngularJS support is turned off by default.
  • Legacy alerting is entirely removed.
  • Subfolders cause very rare issues with folders which have slashes in their names.
  • The input data source is removed.
  • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
  • The URL which is generated when viewing an individual repeated panel has changed.
  • React Router is deprecated.
  • The grafana/e2e testing tool is deprecated.

• This update brings many new features, enhancements and fixes highlighted at:

  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

golang-github-prometheus-node_exporter was updated to version 1.9.1:

• Security issues fixed:

  • CVE-2025-22870: Bumped golang.org/x/net to version 0.37.0 (bsc#1238686)

• Other changes from version 1.9.1: …

This update fixes the following issues:

golang-github-prometheus-prometheus was updated to version 2.53.4:

• Security issues fixed:

  • CVE-2023-45288: Require Go >= 1.23 for building (bsc#1236516)
  • CVE-2025-22870: Bumped golang.org/x/net to version 0.39.0 (bsc#1238686)

• Other bugs fixes from version 2.53.4:

  • Runtime: fixed GOGC being set to 0 when installed with empty prometheus.yml file resulting high cpu usage
  • Scrape: fixed dropping valid metrics after previous scrape failed

prometheus-blackbox_exporter was updated from version 0.24.0 to 0.26.0 (jsc#PED-12872):

• Security issues fixed:

  • CVE-2025-22870: Fixed proxy bypassing using IPv6 zone IDs (bsc#1238680)
  • CVE-2023-45288: Fixed closing connections when receiving too many headers (bsc#1236515)

• Other changes from version 0.26.0:

  • Changes:
    • Replace go-kit/log with log/slog module.
  • Features:
    • Add metric to record tls ciphersuite negotiated during handshake.
    • Add a way to export labels with content matched by the probe. Reports Certificate Serial number.
  • Enhancement:
    • Add stale workflow to start sync with stale.yaml in Prometheus.
  • Bug fixes:
    • Only register grpc TLS metrics on successful handshake.

• Other changes from version 0.25.0:

  • Features:
    • Allow to get Probe logs by target.
    • Log errors from probe.
  • Bug fixes:
    • Prevent logging confusing error message.
    • Explicit registration of internal exporter metrics.

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

• Security issues fixed:

  • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
  • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
  • CVE-2024-9264: SQL Expressions (bsc#1231844)
  • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

• Potential breaking changes in version 11.5.0:

  • Loki: Default to /labels API with query param instead of /series API.

• Potential breaking changes in version 11.0.1:

  • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

• Potential breaking changes in version 11.0.0:

  • AngularJS support is turned off by default.
  • Legacy alerting is entirely removed.
  • Subfolders cause very rare issues with folders which have slashes in their names.
  • The input data source is removed.
  • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
  • The URL which is generated when viewing an individual repeated panel has changed.
  • React Router is deprecated.
  • The grafana/e2e testing tool is deprecated.

• This update brings many new features, enhancements and fixes highlighted at:

  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/

This update for grafana fixes the following issues:

grafana was updated from version 10.4.15 to 11.5.5 (jsc#PED-12918):

• Security issues fixed:

  • CVE-2025-4123: Fix cross-site scripting vulnerability (bsc#1243714).
  • CVE-2025-22872: Bump golang.org/x/net/html (bsc#1241809)
  • CVE-2025-3580: Prevent unauthorized server admin deletion (bsc#1243672).
  • CVE-2025-29923: Bump github.com/redis/go-redis/v9 to 9.6.3.
  • CVE-2025-3454: Sanitize paths before evaluating access to route (bsc#1241683).
  • CVE-2025-2703: Fix built-in XY Chart plugin (bsc#1241687).
  • CVE-2025-22870: Bump golang.org/x/net (bsc#1238703).
  • CVE-2024-9476: Fix Migration Assistant issue (bsc#1233343)
  • CVE-2024-9264: SQL Expressions (bsc#1231844)
  • CVE-2023-45288: Bump golang.org/x/net (bsc#1236510)
  • CVE-2025-22870: Bump golang.org/x/net to version 0.37.0 (bsc#1238686)

• Potential breaking changes in version 11.5.0:

  • Loki: Default to /labels API with query param instead of /series API.

• Potential breaking changes in version 11.0.1:

  • If you had selected your language as 'Portugu�s Brasileiro' previously, this will be reset. You have to select it again in your Preferences for the fix to be applied and the translations will then be shown.

• Potential breaking changes in version 11.0.0:

  • AngularJS support is turned off by default.
  • Legacy alerting is entirely removed.
  • Subfolders cause very rare issues with folders which have slashes in their names.
  • The input data source is removed.
  • Data sources: Responses which are associated with hidden queries will be removed (filtered) by Grafana.
  • The URL which is generated when viewing an individual repeated panel has changed.
  • React Router is deprecated.
  • The grafana/e2e testing tool is deprecated.

• This update brings many new features, enhancements and fixes highlighted at:

  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-5/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-4/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-3/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-2/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-1/
  • https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v11-0/