CVE-2021-27358

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.(CVE-2020-24303)

A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-27846)

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.(CVE-2021-27358)

One of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.(CVE-2021-28148)

The team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn't supposed to have.(CVE-2021-28147)

Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to True (vs default of False), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191)

Security Fix(es):

• golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

• grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)

• golang: net: lookup functions may return invalid host names (CVE-2021-33195)

• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

• golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (7.5.9). (BZ#1921191)

Security Fix(es):

• golang: crypto/elliptic: incorrect operations on the P-224 curve (CVE-2021-3114)

• grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call (CVE-2021-27358)

• golang: net: lookup functions may return invalid host names (CVE-2021-33195)

• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)

• golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

This update for grafana fixes the following issues:

• CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)

• Update to version 7.5.7:

  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model (#33572) (#33586)
  • Update team.md (#33454) (#33536)
  • Removed duplicate file 'dashboard_folder_permissions.md (#33497)
  • Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)
  • ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)
  • Documentation: Update developer-guide.md (#33478) (#33490)
  • add closed parenthesis to fix a hyperlink (#33471) (#33481)

• Update to version 7.5.5:

  • 'Release: Updated versions in package to 7.5.5' (#33469)
  • GraphNG: Fix exemplars window position (#33427) (#33462)
  • Remove field limitation from slack notification (#33113) (#33455)
  • Prometheus: Support POST in template variables (#33321) (#33441)
  • Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)
  • Docs: Removed type from find annotations example. (#33399) (#33403)
  • [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)
  • Updated label for add panel. (#33285) (#33286)
  • Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)
  • Docs: Sync latest master docs with 7.5.x (#33156)
  • Docs: Update getting-started-influxdb.md (#33234) (#33241)
  • Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)
  • Minor Changes in Auditing.md (#31435) (#33238)
  • Docs: Add license check endpoint doc (#32987) (#33236)
  • Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)
  • Docs: InfluxDB doc improvements (#32815) (#33185)
  • [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)
  • update cla (#33181)
  • Fix inefficient regular expression (#33155) (#33159)
  • Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)
  • Elasticsearch: Add documentation for supported Elasticsearch query transformations (#33072)…

This update for grafana fixes the following issues:

• CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)

• Update to version 7.5.7:

  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model (#33572) (#33586)
  • Update team.md (#33454) (#33536)
  • Removed duplicate file 'dashboard_folder_permissions.md (#33497)
  • Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)
  • ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)
  • Documentation: Update developer-guide.md (#33478) (#33490)
  • add closed parenthesis to fix a hyperlink (#33471) (#33481)

• Update to version 7.5.5:

  • 'Release: Updated versions in package to 7.5.5' (#33469)
  • GraphNG: Fix exemplars window position (#33427) (#33462)
  • Remove field limitation from slack notification (#33113) (#33455)
  • Prometheus: Support POST in template variables (#33321) (#33441)
  • Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)
  • Docs: Removed type from find annotations example. (#33399) (#33403)
  • [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)
  • Updated label for add panel. (#33285) (#33286)
  • Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)
  • Docs: Sync latest master docs with 7.5.x (#33156)
  • Docs: Update getting-started-influxdb.md (#33234) (#33241)
  • Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)
  • Minor Changes in Auditing.md (#31435) (#33238)
  • Docs: Add license check endpoint doc (#32987) (#33236)
  • Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)
  • Docs: InfluxDB doc improvements (#32815) (#33185)
  • [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)
  • update cla (#33181)
  • Fix inefficient regular expression (#33155) (#33159)
  • Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)
  • Elasticsearch: Add documentation for supported Elasticsearch query transformations (#33072)…

This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:

Security fixes included in this update:

cassandra:

• CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced correctly for certain internode_encryption settings (bsc#1181689)

grafana:

• CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross site scripting vulnerabilities in the dashboard. (bsc#1172450)
• CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)
• CVE-2019-15043: Fixed a denial of service by an unauthenticated user in the snapshot HTTP API (bsc#1148383)
• CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)
• CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation popup (bsc#1170657)
• CVE-2018-19039: Fixed an issue where a privileged user could exfiltrate files (bsc#1115960)
• CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)
• CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for ElasticSearch datasources (bsc#1178243)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service. (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields. (bsc#1044849)
• CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used by default. (bsc#1171909)

python-Django:

• CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl(). (bsc#1182433)
• CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names. (bsc#1185623)
• CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView. (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks. (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)

python-pysaml2:

• CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed SAML documents. (bsc#1181277)
• CVE-2021-21239: Fixed improper verification of cryptographic signatures when using CryptoBackendXmlSec1(). (bsc#1181278)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions. (bsc#1183174)

Non-security changes included in this update:

Changes in ardana-neutron:

• Update to version 9.0+git.1615223676.777f0b3:
  • Allow users to stop monitoring rootwrap daemon (bsc#1182317)

Changes in ardana-swift:

• Update to version 9.0+git.1618235096.90974ed:
  • Run swiftlm-scan in the UTC timezone (bsc#1181690)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary…

This update for crowbar-openstack, grafana, kibana, monasca-installer, python-Django, python-py, rubygem-activerecord-session_store contains the following fixes:

Security fixes included in this update:

crowbar-openstack:

• CVE-2016-8611: Added rate limiting for the '/images' API POST method (bsc#1005886).

grafana:

• CVE-2021-27358: Fixed a denial of service via remote API call (bsc#1183803)

kibana:

• CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable implementation, which could cause a denial of service (bsc#1044849)
• CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields (bsc#1044849)

python-Django:

• CVE-2021-3281: Fixed a directory traversal via archive.extract() (bsc#1181379)
• CVE-2021-28658: Fixed a directory traversal via uploaded files (bsc#1184148)
• CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted file names (bsc#1185623)
• CVE-2021-33203:Fixed potential path-traversal via admindocs' TemplateDetailView (bsc#1186608)
• CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses, which potentially leads to further attacks (bsc#1186611)

python-py:

• CVE-2020-29651: Fixed a denial of service via regular expressions (bsc#1179805)

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow an attack to hijack sessions (bsc#1183174)

Non-security fixes included in this update:

Changes in crowbar-openstack:

• Update to version 4.0+git.1616146720.44daffca0:
  • monasca: restart Kibana on update (bsc#1044849)

Changes in grafana_Update:

• Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)
  • Prevent unauthenticated remote attackers from causing a DoS through the snapshots API.

Changes in kibana_Update:

• Ensure /etc/sysconfig/kibana is present

• Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14, ESA-2017-16)

  • [4.6] ignore forked code for babel transpile build phase (#13483)
  • Allow more than match queries in custom filters (#8614) (#10857)
  • [state] don't make extra $location.replace() calls (#9954)
  • [optimizer] move to querystring-browser package for up-to-date api
  • [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls
  • server: refactor log_interceptor to be more DRY (#9617)
  • server: downgrade ECANCELED logs to debug (#9616)
  • server: do not treat logged warnings as errors (#8746) (#9610)
  • [server/logger] downgrade EPIPE errors to debug level (#9023)
  • Add basepath when redirecting from a trailling slash (#9035)
  • [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)
  • [server/shortUrl] validate urls before shortening them

• Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)

  • This fixes an XSS vulnerability in URL fields

• Remove %dir declaration from /opt/kibana/optimize to ensure no files owned by root end up in there

• Exclude /opt/kibana/optimize from %fdupes

• Restart service on upgrade

• Do not copy LICENSE.txt and README.txt to /opt/kibana

• Fix rpmlint warnings/errors

• Switch to explicit patch application

• Fix source URL

• Fix logic for systemd/systemv detection

Changes in monasca-installer_Update:

• Add support-influxdb-1.2.patch (SOC-11435)

Changes in python-Django_Update:

• Fixed potential path-traversal via admindocs' TemplateDetailView.(bsc#1186608, CVE-2021-33203)
• Prevented leading zeros in IPv4 addresses. (bsc#1186611, CVE-2021-33571)
• Add delegate-os-path-filename-generation-to-storage.patch (bsc#1185623)
  • Needed for CVE-2021-31542.patch to apply
• Tightened path & file name sanitation in file uploads. (bsc#1185623, CVE-2021-31542)
• Fixed potential directory-traversal via uploaded files. (bsc#1184148, CVE-2021-28658)
• Fixes a potential directory traversal when extracting archives. (bsc#1181379, CVE-2021-3281)

Changes in python-py_Update:

• Add CVE-2020-29651.patch (CVE-2020-29651, bsc#1179805)
  • svnwc: fix regular…

This update for ardana-cobbler, cassandra, cassandra-kit, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, kibana, openstack-heat-templates, openstack-monasca-installer, openstack-nova, python-Django, python-elementpath, python-eventlet, python-py, python-pysaml2, python-six, python-xmlschema fixes the following issues:

Security fixes included on this update:

cassandra-kit:

• CVE-2020-17516: Internode encryption enforcement vulnerability

cassandra:

• CVE-2020-17516: Internode encryption enforcement vulnerability
• CVE-2017-5929 logback: Fixed a serialization vulnerability in SocketServer and ServerSocketReceiver

crowbar-core: CVE-2020-26247: Potentially XXE or SSRF attacks by parsed Nokogiri::XML::Schema

grafana:

• CVE-2021-27358: Unauthenticated remote attackers to trigger a Denial of Service via a remote API call

kibana:

• CVE-2017-11481: Fixed an XSS via URL fields
• CVE-2017-11499: Fixed a constant hashtable seeds vulnerability

python-Django:

• CVE-2021-28658: Potential directory-traversal via uploaded files
• CVE-2021-31542: Potential directory-traversal via uploaded files
• CVE-2021-33203: Potential directory traversal via admindocs
• CVE-2021-33571: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses
• CVE-2021-23336: Fixed web cache poisoning via django.utils.http.limited_parse_qsl

python-eventlet:

• CVE-2021-21419: Improper handling of highly compressed data and memory allocation with excessive size value

python-pysaml2:

• CVE-2021-21238: Fixed an improper verification of cryptographic signatures for signed SAML documents
• CVE-2021-21239: Fixed an improper verification of cryptographic signatures when using CryptoBackendXmlSec1()_

python-py:

• CVE-2020-29651: Regular expression denial of service in svnwc.py

rubygem-activerecord-session_store:

• CVE-2019-25025: Fixed a hijack sessions by using timing attacks targeting the session id CVE-2019-16782

Non-security fixes included on this update:

Changes in ardana-cobbler:

• Update to version 8.0+git.1614096566.e8c2b27:
  • Change install_recommended to true (bsc#1181828)

Changes in cassandra:

• update to 3.11.10 (bsc#1181689, CVE-2020-17516)

• Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)
• Reduce amount of allocations during batch statement execution (CASSANDRA-16201)
• Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)
• Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)
• Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)
• SASI's max_compaction_flush_memory_in_mb settings over 100GB revert to default of 1GB (CASSANDRA-16071)
• Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)
• Improve empty hint file handling during startup (CASSANDRA-16162)
• Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)
• Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)
• Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)
• Synchronize transaction logs for JBOD (CASSANDRA-16225)
• Fix the counting of cells per partition (CASSANDRA-16259)
• Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)
• Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)
• Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)
• Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)
• Remove the SEPExecutor blocking behavior (CASSANDRA-16186)
• Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)
• Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)
• Wait for schema agreement when bootstrapping (CASSANDRA-15158)
• Fix the histogram merge of the table metrics (CASSANDRA-16259)
• Synchronize Keyspace instance store/clear…

This update for grafana fixes the following issues:

• CVE-2021-27358: unauthenticated remote attackers to trigger a Denial of Service via a remote API call (bsc#1183803)

• Update to version 7.5.7:

  • Updated relref to 'Configuring exemplars' section (#34240) (#34243)
  • Added exemplar topic (#34147) (#34226)
  • Quota: Do not count folders towards dashboard quota (#32519) (#34025)
  • Instructions to separate emails with semicolons (#32499) (#34138)
  • Docs: Remove documentation of v8 generic OAuth feature (#34018)
  • Annotations: Prevent orphaned annotation tags cleanup when no annotations were cleaned (#33957) (#33975)
  • [GH-33898] Add missing --no-cache to Dockerfile. (#33906) (#33935)
  • ReleaseNotes: Updated changelog and release notes for 7.5.6 (#33932) (#33936)
  • Stop hoisting @icons/material (#33922)
  • Chore: fix react-color version in yarn.lock (#33914)
  • 'Release: Updated versions in package to 7.5.6' (#33909)
  • Loki: fix label browser crashing when + typed (#33900) (#33901)
  • Document hide_version flag (#33670) (#33881)
  • Add isolation level db configuration parameter (#33830) (#33878)
  • Sanitize PromLink button (#33874) (#33876)
  • Removed content as per MarcusE's suggestion in https://github.com/grafana/grafana/issues/33822. (#33870) (#33872)
  • Docs feedback: /administration/provisioning.md (#33804) (#33842)
  • Docs: delete from high availability docs references to removed configurations related to session storage (#33827) (#33851)
  • Docs: Update _index.md (#33797) (#33799)
  • Docs: Update installation.md (#33656) (#33703)
  • GraphNG: uPlot 1.6.9 (#33598) (#33612)
  • dont consider invalid email address a failed email (#33671) (#33681)
  • InfluxDB: Improve measurement-autocomplete behavior in query editor (#33494) (#33625)
  • add template for dashboard url parameters (#33549) (#33588)
  • Add note to Snapshot API doc to specify that user has to provide the entire dashboard model (#33572) (#33586)
  • Update team.md (#33454) (#33536)
  • Removed duplicate file 'dashboard_folder_permissions.md (#33497)
  • Document customQueryParameters for prometheus datasource provisioning (#33440) (#33495)
  • ReleaseNotes: Updated changelog and release notes for 7.5.5 (#33473) (#33492)
  • Documentation: Update developer-guide.md (#33478) (#33490)
  • add closed parenthesis to fix a hyperlink (#33471) (#33481)

• Update to version 7.5.5:

  • 'Release: Updated versions in package to 7.5.5' (#33469)
  • GraphNG: Fix exemplars window position (#33427) (#33462)
  • Remove field limitation from slack notification (#33113) (#33455)
  • Prometheus: Support POST in template variables (#33321) (#33441)
  • Instrumentation: Add success rate metrics for email notifications (#33359) (#33409)
  • Use either moment objects (for absolute times in the datepicker) or string (for relative time) (#33315) (#33406)
  • Docs: Removed type from find annotations example. (#33399) (#33403)
  • [v7.5.x]: FrontendMetrics: Adds new backend api that frontend can use to push frontend measurements and counters to prometheus (#33255)
  • Updated label for add panel. (#33285) (#33286)
  • Bug: Add git to Dockerfile.ubuntu (#33247) (#33248)
  • Docs: Sync latest master docs with 7.5.x (#33156)
  • Docs: Update getting-started-influxdb.md (#33234) (#33241)
  • Doc: Document the X-Grafana-Org-Id HTTP header (#32478) (#33239)
  • Minor Changes in Auditing.md (#31435) (#33238)
  • Docs: Add license check endpoint doc (#32987) (#33236)
  • Postgres: Fix time group macro when TimescaleDB is enabled and interval is less than a second (#33153) (#33219)
  • Docs: InfluxDB doc improvements (#32815) (#33185)
  • [v7.5.x] Loki: Pass Skip TLS Verify setting to alert queries (#33031)
  • update cla (#33181)
  • Fix inefficient regular expression (#33155) (#33159)
  • Auth: Don't clear auth token cookie when lookup token fails (#32999) (#33136)
  • Elasticsearch: Add documentation for supported Elasticsearch query transformations (#33072)…