{"id":"CVE-2020-24303","aliases":["BIT-grafana-2020-24303","EUVD-2022-4628","GHSA-mvpr-q6rh-8vrp","GO-2024-2520","OESA-2021-1445","RHSA-2021:1859","RLSA-2021:1859","SUSE-SU-2020:3624-1","SUSE-SU-2020:3897-1","SUSE-SU-2021:1233-1","SUSE-SU-2021:1962-1","UBUNTU-CVE-2020-24303"],"status":"published","title":"Grafana XSS via a query alias for the ElasticSearch datasource","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02078,"percentile":0.81769,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-10-28T13:25:22Z","modified":"2026-10-20T10:53:44Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["7.1.0-beta1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["7.0.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-beta1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.0.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.1.0-beta1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.11-1.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.11-1.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.6-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"grafana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.6-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.3.6-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0+git.1604938545.30c10db18-9.77.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-1.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-3.12.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1600802664.7e480a2-3.6.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-mq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1605174486.a78ddce-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-osconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1601621747.a87e5a0-3.22.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-tempest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1603378983.fc0bca9-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.28.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev2-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1605509190.64f020b6-3.9.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev3-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4~dev6-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev57-4.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev135-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-vpnaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.2~dev6-3.9.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev77-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-pytest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-3.15.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20200917-3.24.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-5.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.24.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev7-4.23.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev16-4.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev4-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev57-3.25.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev135-6.23.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev77-3.23.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.21.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.16.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1606314264.bf9ada813-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1604573541.bb18c172d-3.28.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.20.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"influxdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.28.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.19.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev2-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-heat-templates","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0+git.1605509190.64f020b6-3.9.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-horizon-plugin-gbp-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev3-3.3.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic-python-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.4~dev6-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev57-4.30.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev135-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev5-3.19.4"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-vpnaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.2~dev6-3.9.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev77-3.31.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-pytest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.4-3.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23-3.15.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.20200917-3.24.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"spark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.3-5.3.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"system-user-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.1-3.6.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"system-user-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.9.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1615223676.777f0b3-3.25.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"ardana-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0+git.1618235096.90974ed-3.10.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.10-3.3.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.23.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.9.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-3.24.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-3.25.5"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-3.37.4"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev29-3.25.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev82-3.37.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.25.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-elementpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-3.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.6.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-xmlschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-barbican","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.1~dev24-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.10~dev20-3.26.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-designate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2~dev2-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.0.1~dev30-3.21.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.4~dev4-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-4.27.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-4.21.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.2.1~dev4-3.24.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1~dev1-4.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.2~dev60-3.29.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1~dev10-3.21.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-monasca-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2~dev3-3.23.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-6.27.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev82-3.27.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-octavia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3~dev7-4.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-sahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.2~dev15-3.23.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"venv-openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2~dev48-2.18.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"cassandra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.10-3.3.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"crowbar-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0+git.1616146717.a89ae0f4e-3.34.4"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.4-3.23.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-4.9.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.1~dev11-3.24.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-ironic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.1.5~dev17-3.25.5"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.8~dev164-3.37.4"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-neutron-gbp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.1~dev29-3.25.3"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.3.1~dev82-3.37.6"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Django1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.29-3.25.1"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-elementpath","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-3.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-pysaml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-4.6.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-xmlschema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-1.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-activerecord-session_store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2-4.3.2"}]}],"bundled":23},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]}],"products":[{"vendor":"grafana","product":"grafana"}],"references":[{"url":"https://github.com/grafana/grafana/blob/master/CHANGELOG.md#710-beta-1-2020-07-01","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/grafana/grafana/pull/25401","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web","article","report"]},{"url":"https://security.netapp.com/advisory/ntap-20201123-0002/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24303","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20201123-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mvpr-q6rh-8vrp","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1445","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27846","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-27358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28147","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39226","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1859","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850471","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1892418","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1907670","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1916083","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1859.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-24303","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-24303","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-27846","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27846","tags":["advisory"]},{"url":"https://github.com/crewjam/saml/security/advisories/GHSA-4hq8-gmxx-h6w9","tags":["article"]},{"url":"https://grafana.com/blog/2020/12/17/grafana-6.7.5-7.2.3-and-7.3.6-released-with-important-security-fix-for-grafana-enterprise/","tags":["article"]},{"url":"https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1859","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203624-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1005886","tags":["report"]},{"url":"https://bugzilla.suse.com/1170479","tags":["report"]},{"url":"https://bugzilla.suse.com/1177120","tags":["report"]},{"url":"https://bugzilla.suse.com/1178243","tags":["report"]},{"url":"https://bugzilla.suse.com/1178988","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26137","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203897-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1125815","tags":["report"]},{"url":"https://bugzilla.suse.com/1132174","tags":["report"]},{"url":"https://bugzilla.suse.com/1132323","tags":["report"]},{"url":"https://bugzilla.suse.com/1160851","tags":["report"]},{"url":"https://bugzilla.suse.com/1177611","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-5390","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211233-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1148383","tags":["report"]},{"url":"https://bugzilla.suse.com/1170557","tags":["report"]},{"url":"https://bugzilla.suse.com/1170657","tags":["report"]},{"url":"https://bugzilla.suse.com/1172409","tags":["report"]},{"url":"https://bugzilla.suse.com/1172450","tags":["report"]},{"url":"https://bugzilla.suse.com/1175951","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12245","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13379","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1044849","tags":["report"]},{"url":"https://bugzilla.suse.com/1048688","tags":["report"]},{"url":"https://bugzilla.suse.com/1115960","tags":["report"]},{"url":"https://bugzilla.suse.com/1171909","tags":["report"]},{"url":"https://bugzilla.suse.com/1174583","tags":["report"]},{"url":"https://bugzilla.suse.com/1179805","tags":["report"]},{"url":"https://bugzilla.suse.com/1181277","tags":["report"]},{"url":"https://bugzilla.suse.com/1181278","tags":["report"]},{"url":"https://bugzilla.suse.com/1181689","tags":["report"]},{"url":"https://bugzilla.suse.com/1181690","tags":["report"]},{"url":"https://bugzilla.suse.com/1182317","tags":["report"]},{"url":"https://bugzilla.suse.com/1182433","tags":["report"]},{"url":"https://bugzilla.suse.com/1183174","tags":["report"]},{"url":"https://bugzilla.suse.com/1183803","tags":["report"]},{"url":"https://bugzilla.suse.com/1184148","tags":["report"]},{"url":"https://bugzilla.suse.com/1185623","tags":["report"]},{"url":"https://bugzilla.suse.com/1186608","tags":["report"]},{"url":"https://bugzilla.suse.com/1186611","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-25025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-27358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33571","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-24303","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-24303","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2020-10-28T13:25:22Z","modified":"2024-08-04T15:12:08.961Z","updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2022-4628","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2020-10-28T13:25:22Z","modified":"2024-08-04T15:12:08Z","updated_at":"2026-11-03T03:07:19.775117Z"}],"ghsa":[{"id":"GHSA-mvpr-q6rh-8vrp","title":"Grafana XSS via a query alias for the ElasticSearch datasource","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2022-05-24T17:32:32Z","modified":"2024-08-07T05:01:22Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:58.427757Z"}],"nvd":[{"id":"CVE-2020-24303","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2020-10-28T14:15:12.33Z","modified":"2026-06-17T03:05:21.92Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"CVE-2020-24303","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2020-10-28T14:15:12.33Z","modified":"2026-10-20T10:53:44.279447298Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"GHSA-mvpr-q6rh-8vrp","title":"Grafana XSS via a query alias for the ElasticSearch datasource","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2022-05-24T17:32:32Z","modified":"2026-09-10T03:49:35.028179722Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"OESA-2021-1445","title":"grafana security update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026amp; OpenTSDB.\r\n\r\nSecurity Fix(es):\r\n\r\nGrafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.(CVE-2020-24303)\r\n\r\nA signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2020-27846)\r\n\r\nThe snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.(CVE-2021-27358)\r\n\r\nOne of the usage insights HTTP API endpoints in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 is accessible without any authentication. This allows any unauthenticated user to send an unlimited number of requests to the endpoint, leading to a denial of service (DoS) attack against a Grafana Enterprise instance.(CVE-2021-28148)\r\n\r\nThe team sync HTTP API in Grafana Enterprise 6.x before 6.7.6, 7.x before 7.3.10, and 7.4.x before 7.4.5 has an Incorrect Access Control issue. On Grafana instances using an external authentication service and having the EditorsCanAdmin feature enabled, this vulnerability allows any authenticated user to add external groups to any existing team. This can be used to grant a user team permissions that the user isn\u0026apos;t supposed to have.(CVE-2021-28147)\r\n\r\nGrafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot \u0026quot;public_mode\u0026quot; configuration setting is set to True (vs default of False), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot \u0026quot;public_mode\u0026quot; setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects.(CVE-2021-39226)","status":"published","published":"2021-11-26T11:04:43Z","modified":"2026-08-18T01:16:12.533143455Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:1859","title":"Red Hat Security Advisory: grafana security, bug fix, and enhancement update","status":"published","published":"2024-09-18T04:18:09Z","modified":"2026-03-27T10:16:44.688667Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1859","title":"Moderate: grafana security, bug fix, and enhancement update","description":"Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nThe following packages have been upgraded to a later upstream version: grafana (7.3.6). (BZ#1850471)\n\nSecurity Fix(es):\n\n* crewjam/saml: authentication bypass in saml authentication (CVE-2020-27846)\n\n* grafana: XSS via a query alias for the Elasticsearch and Testdata datasource (CVE-2020-24303)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.","status":"published","published":"2021-05-18T06:16:06Z","modified":"2026-02-05T02:00:11.142563Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-24303","description":"Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2020-10-28T14:15:00Z","modified":"2025-10-24T04:48:40Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"BIT-grafana-2020-24303","description":"Grafana before 7.1.0 allows XSS via a query alias for the ElasticSearch datasource.","status":"published","published":"2024-03-06T11:00:38.605Z","modified":"2026-09-08T08:47:49.92492626Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"GO-2024-2520","title":"Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana","description":"Grafana XSS via a query alias for the ElasticSearch datasource in github.com/grafana/grafana.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/grafana/grafana before v7.1.0-beta1.","status":"published","published":"2024-06-28T15:28:53Z","modified":"2026-06-19T12:44:18.77214532Z","updated_at":"2026-11-02T15:47:01.185262Z"},{"id":"SUSE-SU-2020:3624-1","title":"Security update for crowbar-openstack, grafana, influxdb, python-urllib3","description":"This update for crowbar-openstack, grafana, influxdb, python-urllib3 contains the following fixes:\n\nSecurity fixes included in this update:\n\nopenstack-glance\n- CVE-2016-8611: Added rate limiting for glance api (bnc#1005886)\n\ngrafana\n- CVE-2020-24303: Fixed an XSS via a query alias for the ElasticSearch datasource (#bnc#1178243)\n\ninfluxdb\n- CVE-2019-20933: Fixed an authentication bypass (bnc#1178988)\n\npython-urlib3\n- CVE-2019-9740: Fixed a CRLF injection in urllib3 (bnc#1129071).\n- CVE-2020-26137: Fixed a CRLF injection via HTTP request method (bnc#1177120)\n\nmemcached\n- CVE-2018-1000115: Fixed a issue where a UDP server allowed spoofed traffic amplification DoS (bnc#1083903).\n\nNon-security fixes included in this update:\n\nChanges in crowbar-openstack:\n- Update to version 4.0+git.1604938545.30c10db18:\n  * rabbitmq: Fix crm running check (SOC-11240)\n\nChanges in grafana:\n- Fix bnc#1178243 CVE-2020-24303 by adding\n  25401-Fix-XSS-vulnerability-with-series-overrides.patch\n\nChanges in influxdb:\n- Add CVE-2019-20933.patch (bnc#1178988, CVE-2019-20933) to\n  fix authentication bypass_\n- Declare license files correctly\n\n- Version 1.2.4:\n  * The stress tool influx_stress will be removed in a subsequent\n    release.\n  * Remove the override of GOMAXPROCS.\n  * Uncomment section headers from the default configuration file.\n  * Improve write performance significantly.\n  * Prune data in meta store for deleted shards.\n  * Update latest dependencies with Godeps.\n  * Introduce syntax for marking a partial response with chunking.\n  * Use X-Forwarded-For IP address in HTTP logger if present.\n  * Add support for secure transmission via collectd.\n  * Switch logging to use structured logging everywhere.\n  * [CLI feature request] USE retention policy for queries.\n  * Add clear command to cli.\n  * Adding ability to use parameters in queries in the v2 client\n    using the Parameters map in the Query struct.\n  * Allow add items to array config via ENV\n  * Support subquery execution in the query language.\n  * Verbose output for SSL connection errors.\n  * Cache snapshotting performance improvements\n\n- Partially revert previous change to fix build for Leap\n\nChanges in python-urllib3:\n- Update urllib3-fix-test-urls.patch. Adjust to match upstream solution.\n\n- Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for\n  CVE-2019-9740.\n\n- Add urllib3-cve-2020-26137.patch. Don't allow control chars in request\n  method. (bnc#1177120, CVE-2020-26137)\n\n  ","status":"published","published":"2020-12-04T11:50:23Z","modified":"2025-05-02T04:10:02.691016Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2020:3897-1","title":"Security update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark","description":"This update for ardana-cassandra, ardana-mq, ardana-osconfig, ardana-tempest, crowbar-core, crowbar-openstack, grafana, influxdb, openstack-cinder, openstack-heat, openstack-heat-gbp, openstack-heat-templates, openstack-horizon-plugin-gbp-ui, openstack-ironic-python-agent, openstack-manila, openstack-neutron, openstack-neutron-gbp, openstack-neutron-vpnaas, openstack-nova, python-Jinja2, python-pysaml2, python-pytest, python-urllib3, release-notes-suse-openstack-cloud, spark fixes the following issues:\n\nSecurity changes included on this update:\n\ngrafana:\n- CVE-2020-24303: Fixed an XXS with series overides. (bsc#1178243)\n\ninfluxdb:\n- CVE-2019-20933: Fixed an authentication bypass. (bsc#1178988)\n\npython-Jinja2:\n- CVE-2019-10906,CVE-2019-8341,CVE-2016-10745: 'SandboxedEnvironment' securely handles 'str.format_map' in order\n  to prevent code execution through untrusted format strings. (bsc#1132323, bsc#1125815, bsc#1132174)\n\npython-pysaml2:\n- CVE-2020-5390: Fixed an issue where there was no check that the signature in a SAML document is enveloped. (bsc#1160851)\n\npython-urllib3:\n- CVE-2020-26137: Fixed a CRLF injection via HTTP request method. (bsc#1177120)\n\nNon-security changes included in this update:\n\nChanges in ardana-cassandra:\n- Update to version 9.0+git.1600802664.7e480a2:\n  * Remove freezer related backup/restore code (SOC-7751)\n\nChanges in ardana-mq:\n- Update to version 9.0+git.1605174486.a78ddce:\n  * Re-enable mirroring of fanout and reply queues (bsc#1177611)\n\nChanges in ardana-osconfig:\n- Update to version 9.0+git.1601621747.a87e5a0:\n  * HOS8 check needs to be a shell rather than command (SOC-11184)\n\nChanges in ardana-tempest:\n- Update to version 9.0+git.1603378983.fc0bca9:\n  * Enable VPNaaS testing (SOC-8764)\n\n- Update to version 9.0+git.1599855218.875b2f3:\n  * unblacklist some revert tests (SOC-9178)\n\nChanges in crowbar-core:\n- Update to version 6.0+git.1606314264.bf9ada813:\n  * ntp: Do not use rate-limiting (bsc#1179161)\n\n- Update to version 6.0+git.1600414599.150832ca2:\n  * Ignore CVE-2020-15169 (SOC-11391)\n\nChanges in crowbar-openstack:\n- Update to version 6.0+git.1604573541.bb18c172d:\n  * rabbitmq: Fix crm running check (SOC-11240)\n\n- Update to version 6.0+git.1604491402.b4dbba849:\n  * Remove aspiers from CODEOWNERS\n  * Remove cmurphy from CODEOWNERS\n\nChanges in grafana:\n- Fix bsc#1178243 CVE-2020-24303 by adding\n  25401-Fix-XSS-vulnerability-with-series-overrides.patch \n\nChanges in influxdb:\n- Add CVE-2019-20933.patch (bsc#1178988, CVE-2019-20933) to\n  fix authentication bypass \n- Declare license files correctly\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev20:\n  * PowerMax Driver - Legacy volumes fail to live migrate\n\n- Update to version cinder-13.0.10.dev19:\n  * RBD: Cleanup temporary file during exception\n\n- Update to version cinder-13.0.10.dev17:\n  * Remove experimental job legacy-tempest-dsvm-zeromq-multibackend\n\nChanges in openstack-cinder:\n- Update to version cinder-13.0.10.dev20:\n  * PowerMax Driver - Legacy volumes fail to live migrate\n\n- Update to version cinder-13.0.10.dev19:\n  * RBD: Cleanup temporary file during exception\n\n- Update to version cinder-13.0.10.dev17:\n  * Remove experimental job legacy-tempest-dsvm-zeromq-multibackend\n\nChanges in openstack-heat:\n- Update to version openstack-heat-11.0.4.dev4:\n  * Check external resources after creation\n\n- Update to version openstack-heat-11.0.4.dev2:\n  * Don't store signal\\_url for ec2 signaling of deployments\n  * Allow scale-down of ASG as part of update\n  11.0.3\n\nChanges in openstack-heat:\n- Update to version openstack-heat-11.0.4.dev4:\n  * Check external resources after creation\n\n- Update to version openstack-heat-11.0.4.dev2:\n  * Don't store signal\\_url for ec2 signaling of deployments\n  * Allow scale-down of ASG as part of update\n  11.0.3\n\nChanges in openstack-heat-gbp:\n- Update to version group-based-policy-automation-12.0.1.dev2:\n  * Add support for victoria\n\n- Update to version group-based-policy-automation-12.0.1.dev1:\n  * Add network\\_id field for L2 Policy Heat Extensions\n  12.0.0\n  * Add support for ussuri\n  * Fix master/train gate\n  * Add support for train\n  10.0.0\n  * Upgrade for stable/stein branch\n  9.0.0\n  * Updated with 'stable/rocky' branch\n  * Replace openstack.org URLs with 'git+https://'\n  * OpenDev Migration Patch\n\nChanges in openstack-heat-templates:\n- Update to version 0.0.0+git.1605509190.64f020b:\n  * Fix software config on rdo\n  * optimize size and time using --no-cache-dir\n  * add template for servers using Octavia\n\n- Update to version 0.0.0+git.1604032742.c5733ee:\n  * Move heat-templates-check job to zuul v3\n\nChanges in openstack-horizon-plugin-gbp-ui:\n- Update to version group-based-policy-ui-12.0.1.dev3:\n  * Remove mox3 from requirements\n\n- Update to version group-based-policy-ui-12.0.1.dev2:\n  * Fix python namespacing\n  * Add stable victoria\n  12.0.0\n  * Add support for ussuri\n  * Fix master/train gate\n  * Add support for train\n  10.0.0\n  * Upgrade for stable/stein branch\n  9.0.0\n  * Upgrading for stable/rocky branch\n  * Added Python3 support\n  * OpenDev Migration Patch\n\nChanges in openstack-ironic-python-agent:\n- Update to version ironic-python-agent-3.3.4.dev6:\n  * Fix: make Intel CNA hardware manager none generic\n\nChanges in openstack-manila:\n- Update to version manila-7.4.2.dev57:\n  * fix reno file location and indention\n\n- Update to version manila-7.4.2.dev56:\n  * [Glusterfs] Fix delete share, Couldn't find the 'gluster\\_used\\_vols'\n\n- Update to version manila-7.4.2.dev55:\n  * [Glusterfs] Fix delete share, mount point not disconnected\n\nChanges in openstack-manila:\n- Update to version manila-7.4.2.dev57:\n  * fix reno file location and indention\n\n- Update to version manila-7.4.2.dev56:\n  * [Glusterfs] Fix delete share, Couldn't find the 'gluster\\_used\\_vols'\n\n- Update to version manila-7.4.2.dev55:\n  * [Glusterfs] Fix delete share, mount point not disconnected\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev135:\n  * Rehome api tests for propagate\\_uplink\\_status\n\n- Update to version neutron-13.0.8.dev134:\n  * Revert '[Security] fix allowed-address-pair 0.0.0.0/0 issue'\n\n- Update to version neutron-13.0.8.dev132:\n  * Drop invalid rootwrap filters\n  * ovs firewall: fix mac learning on the ingress rule table when ovs offload enabled\n  * Add update\\_id for ResourceUpdate\n\n- Update to version neutron-13.0.8.dev126:\n  * 'ping'/'ping6' command support in rootwrap filters\n\n- Update to version neutron-13.0.8.dev124:\n  * Import 'oslo\\_config.cfg' before 'eventlet'\n  * [OvS] Handle re\\_added multi ports\n\n- Update to version neutron-13.0.8.dev120:\n  * Local mac direct flow for non-openflow firewall\n  * Replace ctype.CDLL by ctypes.PyDLL in linux.ip\\_lib\n\n- Update to version neutron-13.0.8.dev116:\n  * Support gateway which is not in subnet CIDR in ha\\_router\n  * Ensure fip ip rules deleted when fip removed\n\n- Update to version neutron-13.0.8.dev112:\n  * windows: fix terminating processes\n  * [stable/rocky] Drop rally job\n  * Don't raise FileNotFoundError during disabling keepalived\n  * Load the glibc library only once for Pyroute2\n\n- Update to version neutron-13.0.8.dev106:\n  * Do not fail deleting namespace if it does not exist\n\n- Update to version neutron-13.0.8.dev104:\n  * Avoid raising NetworkInterfaceNotFound exception in DHCP agent logs\n\n- Update to version neutron-13.0.8.dev103:\n  * Use dict .get() to avoid a KeyError in the segment plugin\n\n- Update to version neutron-13.0.8.dev101:\n  * Pass context in l3 flavor notifications\n  * Handle properly existing LLA address during l3 agent restart\n\n- Update to version neutron-13.0.8.dev97:\n  * Add 'keepalived\\_use\\_no\\_track' config option\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev135:\n  * Rehome api tests for propagate\\_uplink\\_status\n\n- Update to version neutron-13.0.8.dev134:\n  * Revert '[Security] fix allowed-address-pair 0.0.0.0/0 issue'\n\n- Update to version neutron-13.0.8.dev132:\n  * Drop invalid rootwrap filters\n  * ovs firewall: fix mac learning on the ingress rule table when ovs offload enabled\n  * Add update\\_id for ResourceUpdate\n\n- Update to version neutron-13.0.8.dev126:\n  * 'ping'/'ping6' command support in rootwrap filters\n\n- Update to version neutron-13.0.8.dev124:\n  * Import 'oslo\\_config.cfg' before 'eventlet'\n  * [OvS] Handle re\\_added multi ports\n\n- Update to version neutron-13.0.8.dev120:\n  * Local mac direct flow for non-openflow firewall\n  * Replace ctype.CDLL by ctypes.PyDLL in linux.ip\\_lib\n\n- Update to version neutron-13.0.8.dev116:\n  * Support gateway which is not in subnet CIDR in ha\\_router\n  * Ensure fip ip rules deleted when fip removed\n\n- Update to version neutron-13.0.8.dev112:\n  * windows: fix terminating processes\n  * [stable/rocky] Drop rally job\n  * Don't raise FileNotFoundError during disabling keepalived\n  * Load the glibc library only once for Pyroute2\n\n- Update to version neutron-13.0.8.dev106:\n  * Do not fail deleting namespace if it does not exist\n\n- Update to version neutron-13.0.8.dev104:\n  * Avoid raising NetworkInterfaceNotFound exception in DHCP agent logs\n\n- Update to version neutron-13.0.8.dev103:\n  * Use dict .get() to avoid a KeyError in the segment plugin\n\n- Update to version neutron-13.0.8.dev101:\n  * Pass context in l3 flavor notifications\n  * Handle properly existing LLA address during l3 agent restart\n\n- Update to version neutron-13.0.8.dev97:\n  * Add 'keepalived\\_use\\_no\\_track' config option\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-12.0.1.dev5:\n  * Fix ICMP type and ICMP code fields for named and numbered ICMP Protocol\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev4:\n  * Fix erroneous comma (,) in the LOG.exception call\n  2014.2rc1\n\n- Update to version group-based-policy-12.0.1.dev3:\n  * Fix top of tree in gate\n  * Endpoint level qos changes\n  12.0.0\n  * Add support for ussuri\n  * Update subnets for SVI port corresponding to bound port\n  * Fix the intermittent QOS UT failure\n  * Fixed the QOS UT failure\n  * Use train branch instead of stein\n  * Add support for train\n  * Prepare for removal of CommonDbMixin\n  * Make AIM dsvm job voting\n  * Add support for upstream Stein release\n  * Fix python2/3 compatibility\n  * Fix DNS Domain Name in endpoint file\n  * When a subnet added to a bound SVI port, ensure it is added to SVI port\n  * Add support for qos\n  * Fix DNS issue in endpoint file\n  * [AIM] Add pre-existing BD to network extension\n  * Remove get\\_current\\_session\n  * Remove get\\_current\\_session method\n  * [AIM] Add EPG contract masters to network extension\n  * Revert 'Remove get\\_current\\_session method'\n  * Remove get\\_current\\_session method\n  * Support Dual Stack on SVI nets along with BGP\n  9.0.0\n  * Add support for upstream Rocky release\n  * Cleanup Queens (part 2)\n  * Fix missing DB migration\n  * Make aim functional gate job voting\n  * Added Python3 support\n  * [AIM] Sanitize the AIM tenant description field\n  * Fix field sizes for VM names\n  * Bind baremetal VNIC trunk ports\n  * Fix missing trunk\\_details for a trunk without subports\n  * [AIM] Insert remote\\_group\\_id to SG rules properly\n  * Revert '[AIM] Convert remote\\_ips for SG rules properly'\n  * Cleanup Queens\n  * [AIM] Convert remote\\_ips for SG rules properly\n  * Clean up baremetal port handling\n  * [AIM] Clean up the mock and stop the looping thread in the UT env\n  * Don't stop this looping thread when an exception is thrown\n  * [AIM] Fix router\\_id allocation for SVI\n  * Support non SVI static VLAN type segments with OpFlex agent\n  * Baremetal VNIC Trunk support\n  * [AIM] Don't queue notifications (4 of 4)\n  * [AIM] Don't queue registry callbacks (3 of 4)\n  * [AIM] Enable Neutron transaction guards (2 of 4)\n  * Don't call GBP or Neutron APIs from GBP PD precommit methods\n  * [AIM] Retry L3 Plugin Operations\n  * [AIM] Fix most common random UT failures\n  * [AIM] Fixed external subnet ANY\\_CIDRs for l3out EPGs for SVI\n  * Revert 'Nested domain parameters support for openShift networks'\n  * Fix for unbinding baremetal VNIC ports\n  * Nested domain parameters support for openShift networks\n  * Fix tox coverage job\n  * Add suport for baremetal vnic\\_type\n  2014.2.rc1\n\nChanges in openstack-neutron-vpnaas:\n- Remove remove-tempest-entry-point.patch thus enabling the\n  tempest_vpnaas plugin for tempest testing. (SCRD-8681)\n- Package the neutron-vpnaas/tests/ directory contents in a new RPM\n  RPM package, python-neutron-vpnaas-tempest-plugin, that depend on\n  python-neutron-vpnaas, which provides the main neutron-vpnaas\n  code base. Additionally this new package can now safely depend on\n  the python-neutron-tempest-plugin package, providing the required\n  neutron_tempest_plugin module, without causing tempest packages\n  to be installed when python-neutron-vpnaas installed. (SOC-8764)\n  NOTE: This implicitly enables the neutron_tempest_plugin.\n- Corrected LBaaS references to VPNaaS.\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev77:\n  * Follow up for cherry-pick check for merge patch\n\n- Update to version nova-18.3.1.dev76:\n  * post live migration: don't call Neutron needlessly\n\n- Update to version nova-18.3.1.dev74:\n  * libvirt: Do not reference VIR\\_ERR\\_DEVICE\\_MISSING when libvirt is smaller than v4.1.0\n\n- Update to version nova-18.3.1.dev72:\n  * libvirt: Handle VIR\\_ERR\\_DEVICE\\_MISSING when detaching devices\n\n- Update to version nova-18.3.1.dev70:\n  * compute: Don't delete the original attachment during pre LM rollback\n  * Add regression tests for bug #1889108\n  * compute: refactor volume bdm rollback error handling\n\n- Update to version nova-18.3.1.dev64:\n  * compute: Use source\\_bdms to reset attachment\\_ids during LM rollback\n  * Robustify attachment tracking in CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev60:\n  * Improve CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev58:\n  * Removed the host FQDN from the exception message\n\n- Update to version nova-18.3.1.dev56:\n  * libvirt: Provide VIR\\_MIGRATE\\_PARAM\\_PERSIST\\_XML during live migration\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev77:\n  * Follow up for cherry-pick check for merge patch\n\n- Update to version nova-18.3.1.dev76:\n  * post live migration: don't call Neutron needlessly\n\n- Update to version nova-18.3.1.dev74:\n  * libvirt: Do not reference VIR\\_ERR\\_DEVICE\\_MISSING when libvirt is smaller than v4.1.0\n\n- Update to version nova-18.3.1.dev72:\n  * libvirt: Handle VIR\\_ERR\\_DEVICE\\_MISSING when detaching devices\n\n- Update to version nova-18.3.1.dev70:\n  * compute: Don't delete the original attachment during pre LM rollback\n  * Add regression tests for bug #1889108\n  * compute: refactor volume bdm rollback error handling\n\n- Update to version nova-18.3.1.dev64:\n  * compute: Use source\\_bdms to reset attachment\\_ids during LM rollback\n  * Robustify attachment tracking in CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev60:\n  * Improve CinderFixtureNewAttachFlow\n\n- Update to version nova-18.3.1.dev58:\n  * Removed the host FQDN from the exception message\n\n- Rebased patches:\n  + 0004-Provide-VIR_MIGRATE_PARAM_PERSIST_XML-during-live-migration.patch dropped (merged upstream)\n\n- Update to version nova-18.3.1.dev56:\n  * libvirt: Provide VIR\\_MIGRATE\\_PARAM\\_PERSIST\\_XML during live migration\n\nChanges in python-Jinja2:\n- Trim bias from descriptions. Make sure % is escaped.\n\n- update to version 2.10.1 (bsc#1132323, CVE-2019-10906, bsc#1125815, CVE-2019-8341):\n  * 'SandboxedEnvironment' securely handles 'str.format_map' in order\n    to prevent code execution through untrusted format strings.  The\n    sandbox already handled 'str.format'.\n\n- Activate test suite\n- Add minimum build dependency to match runtime dependency\n\n- Fix fdupes call\n\n- Remove superfluous devel dependency for noarch package\n\n- Update to 2.9.5 (bsc#1132174, CVE-2016-10745)\nChanges in python-pysaml2:\n- Add 0001-Fix-XML-Signature-Wrapping-XSW-vulnerabilities.patch\n  (CVE-2020-5390, bsc#1160851)\n\nChanges in python-pytest:\n- update to 3.7.4\n- drop 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix possible infinite recursion when writing .pyc files\n * Cache plugin now obeys the -q flag when --last-failed and\n     --failed-first flags are used.\n * Fix bad console output when using console_output_style=classic\n * Fixtures during teardown can again use capsys and capfd to inspect\n     output captured during tests.\n * Fix bugs where unicode arguments could not be passed to testdir.runpytest\n     on Python 2.\n * Fix double collection of tests within packages when the filename starts\n     with a capital letter\n * Fix collection error when specifying test functions directly in the command\n     line using test.py::test syntax together with --doctest-modules\n  * Fix stdout/stderr not getting captured when real-time cli logging is active.\n  * Fix bug where --show-capture=no option would still show logs printed during\n     fixture teardown.\n  * Fix issue where teardown of fixtures of consecutive sub-packages were\n     executed once, at the end of the outer package.\n\n- update to 3.7.2\n- add 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix filterwarnings not being registered as a builtin mark.\n * Fix test collection from packages mixed with normal directories.\n * Fix infinite recursion during collection if a pytest_ignore_collect\n    hook returns False instead of None.\n * Fix bug where decorated fixtures would lose functionality\n * Fix bug where importing modules or other objects with prefix pytest_ prefix\n    would raise a PluginValidationError.\n * Fix AttributeError during teardown of TestCase subclasses which raise\n    an exception during __init__.\n * Fix traceback reporting for exceptions with __cause__ cycles.\n\nChanges in python-pytest:\n- update to 3.7.4\n- drop 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix possible infinite recursion when writing .pyc files\n * Cache plugin now obeys the -q flag when --last-failed and\n     --failed-first flags are used.\n * Fix bad console output when using console_output_style=classic\n * Fixtures during teardown can again use capsys and capfd to inspect\n     output captured during tests.\n * Fix bugs where unicode arguments could not be passed to testdir.runpytest\n     on Python 2.\n * Fix double collection of tests within packages when the filename starts\n     with a capital letter\n * Fix collection error when specifying test functions directly in the command\n     line using test.py::test syntax together with --doctest-modules\n  * Fix stdout/stderr not getting captured when real-time cli logging is active.\n  * Fix bug where --show-capture=no option would still show logs printed during\n     fixture teardown.\n  * Fix issue where teardown of fixtures of consecutive sub-packages were\n     executed once, at the end of the outer package.\n\n- update to 3.7.2\n- add 0001-Use-unittest.mock-if-is-only-aviable.patch\n * Fix filterwarnings not being registered as a builtin mark.\n * Fix test collection from packages mixed with normal directories.\n * Fix infinite recursion during collection if a pytest_ignore_collect\n    hook returns False instead of None.\n * Fix bug where decorated fixtures would lose functionality\n * Fix bug where importing modules or other objects with prefix pytest_ prefix\n    would raise a PluginValidationError.\n * Fix AttributeError during teardown of TestCase subclasses which raise\n    an exception during __init__.\n * Fix traceback reporting for exceptions with __cause__ cycles.\n\nChanges in python-urllib3:\n- Update urllib3-fix-test-urls.patch. Adjust to match upstream solution.\n\n- Add urllib3-fix-test-urls.patch. Fix tests failing on python checks for\n  CVE-2019-9740.\n\n- Add urllib3-cve-2020-26137.patch. Don't allow control chars in request\n  method. (bsc#1177120, CVE-2020-26137)\n\nChanges in release-notes-suse-openstack-cloud:\n- Update to version 9.20200917:\n  * Change wording to correctly refer to future SES versions\n  * Update adoc/limitations.adoc\n  * Add SES version limitation, remove deprecated note about Octavia for Crowbar\n\n- Update to version 9.20200917:\n  * Announce Upgrade is now available (SOC-9781)\n\nChanges in spark:\n- Add _constraints to prevent build from running out of disk space \n\n  ","status":"published","published":"2020-12-21T12:51:34Z","modified":"2026-02-04T04:16:03.397106Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1233-1","title":"Security update for grafana and system-user-grafana","description":"This update for grafana and system-user-grafana fixes the following issues:\n\n- Updated grafana to upstream version 7.3.1\n  * CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.\n    This makes it possible to run a denial of service attack against the server running Grafana\n  * CVE-2020-12245: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip (bsc#1170557)\n  * CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue.\n    This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and\n    return its result to the user/client. This can be used to gain information about the network that Grafana is\n    running on. Furthermore, passing invalid URL objects could be used for DOS'ing Grafana via SegFault (bsc#1172409)\n  * CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.\n    This makes it possible to run a denial of service attack against the server running Grafana (bsc#1148383)\n  * CVE-2020-12052: Grafana version below 6.7.3 is vulnerable for annotation popup XSS (bsc#1170657)\n  * CVE-2020-24303: Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource. (bsc#1178243)\n  * CVE-2018-18623: Grafana 5.3.1 has XSS via the 'Dashboard \u003e Text Panel' screen (bsc#1172450)\n  * CVE-2019-19499: Grafana versions below or equal to 6.4.3 has an Arbitrary File Read vulnerability, which\n    could be exploited by an authenticated attacker that has privileges to modify the data source configurations (bsc#1175951)\n\n  * Please refer to this package's changelog to get a full list of all changes (including bug fixes etc.)\n\n- Initial shipment of system-user-grafana to SES 6","status":"published","published":"2021-04-15T15:21:15Z","modified":"2026-02-04T03:29:25.223595Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1962-1","title":"Security update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone","description":"This update for ardana-neutron, ardana-swift, cassandra, crowbar-openstack, grafana, kibana, openstack-dashboard, openstack-ironic, openstack-neutron, openstack-neutron-gbp, openstack-nova, python-Django1, python-py, python-pysaml2, python-xmlschema, rubygem-activerecord-session_store, venv-openstack-keystone contains the following fixes:\n\nSecurity fixes included in this update:\n\ncassandra:\n- CVE-2020-17516: Fixed an issue where encryption between nodes was not enforced\n correctly for certain internode_encryption settings (bsc#1181689)\n\ngrafana:\n- CVE-2018-18623, CVE-2018-18624, CVE-2018-18625: Fixed multiple cross\n site scripting vulnerabilities in the dashboard. (bsc#1172450)\n- CVE-2021-27358: Fixed a denial of service via remote API call. (bsc#1183803)\n- CVE-2019-15043: Fixed a denial of service by an unauthenticated user\n in the snapshot HTTP API (bsc#1148383)\n- CVE-2020-13379: Fixed an information leak to unauthenticated users. (bsc#1172409)\n- CVE-2020-12052: Fixed a cross site scripting vulnerability with the annotation\n popup (bsc#1170657)\n- CVE-2018-19039: Fixed an issue where a privileged user could\n exfiltrate files (bsc#1115960)\n- CVE-2020-11110: Fixed a stored cross site scripting vulnerability. (bsc#1174583)\n- CVE-2020-24303: Fixed a cross site scripting vulnerability in a query alias for\n ElasticSearch datasources (bsc#1178243)\n\nkibana:\n- CVE-2017-11499: Fixed a vulnerability in nodejs, related to the HashTable\n implementation, which could cause a denial of service. (bsc#1044849)\n- CVE-2017-11481: Fixed a cross site scripting vulnerability via via URL fields.\n (bsc#1044849)\n- CVE-2020-10743: Fixed a clickjacking issue because X-Frame-Option was not used\n by default. (bsc#1171909)\n\npython-Django:\n- CVE-2021-23336: Fixed a web cache poisoning via django.utils.http.limited_parse_qsl().\n (bsc#1182433)\n- CVE-2021-28658: Fixed a directory traversal via uploaded files. (bsc#1184148)\n- CVE-2021-31542: Fixed a directory traversal via uploaded files with suitably crafted\n file names. (bsc#1185623)\n- CVE-2021-33203: Fixed potential path-traversal via admindocs' TemplateDetailView.\n (bsc#1186608)\n- CVE-2021-33571: Tighten validator checks to not allow leading zeros in IPv4 addresses,\n which potentially leads to further attacks. (bsc#1186611)\n\npython-py:\n- CVE-2020-29651: Fixed a denial of service via regular expressions. (bsc#1179805)\n\npython-pysaml2:\n- CVE-2021-21238: Fixed improper verification of cryptographic signatures for signed\n SAML documents. (bsc#1181277)\n- CVE-2021-21239: Fixed improper verification of cryptographic signatures when using\n CryptoBackendXmlSec1(). (bsc#1181278)\n\nrubygem-activerecord-session_store:\n- CVE-2019-25025: Fixed a timing attacks targeting the session id which could allow\n an attack to hijack sessions. (bsc#1183174)\n\n\nNon-security changes included in this update:\n\nChanges in ardana-neutron:\n- Update to version 9.0+git.1615223676.777f0b3:\n  * Allow users to stop monitoring rootwrap daemon (bsc#1182317)\n\nChanges in ardana-swift:\n- Update to version 9.0+git.1618235096.90974ed:\n  * Run swiftlm-scan in the UTC timezone (bsc#1181690)\n\nChanges in cassandra:\n- update to 3.11.10 (bsc#1181689, CVE-2020-17516)  \n * Fix digest computation for queries with fetched but non queried columns (CASSANDRA-15962)\n * Reduce amount of allocations during batch statement execution (CASSANDRA-16201)\n * Update jflex-1.6.0.jar to match upstream (CASSANDRA-16393)\n * Fix DecimalDeserializer#toString OOM (CASSANDRA-14925)\n * Rate limit validation compactions using compaction_throughput_mb_per_sec (CASSANDRA-16161)\n * SASI's `max_compaction_flush_memory_in_mb` settings over 100GB revert to default of 1GB (CASSANDRA-16071)\n * Prevent unbounded number of pending flushing tasks (CASSANDRA-16261)\n * Improve empty hint file handling during startup (CASSANDRA-16162)\n * Allow empty string in collections with COPY FROM in cqlsh (CASSANDRA-16372)\n * Fix skipping on pre-3.0 created compact storage sstables due to missing primary key liveness (CASSANDRA-16226)\n * Extend the exclusion of replica filtering protection to other indices instead of just SASI (CASSANDRA-16311)\n * Synchronize transaction logs for JBOD (CASSANDRA-16225)\n * Fix the counting of cells per partition (CASSANDRA-16259)\n * Fix serial read/non-applying CAS linearizability (CASSANDRA-12126)\n * Avoid potential NPE in JVMStabilityInspector (CASSANDRA-16294)\n * Improved check of num_tokens against the length of initial_token (CASSANDRA-14477)\n * Fix a race condition on ColumnFamilyStore and TableMetrics (CASSANDRA-16228)\n * Remove the SEPExecutor blocking behavior (CASSANDRA-16186)\n * Fix invalid cell value skipping when reading from disk (CASSANDRA-16223)\n * Prevent invoking enable/disable gossip when not in NORMAL (CASSANDRA-16146)\n * Wait for schema agreement when bootstrapping (CASSANDRA-15158)\n * Fix the histogram merge of the table metrics (CASSANDRA-16259)\n * Synchronize Keyspace instance store/clear (CASSANDRA-16210)\n * Fix ColumnFilter to avoid querying cells of unselected complex columns (CASSANDRA-15977)\n * Fix memory leak in CompressedChunkReader (CASSANDRA-15880)\n * Don't attempt value skipping with mixed version cluster (CASSANDRA-15833)\n * Avoid failing compactions with very large partitions (CASSANDRA-15164)\n * Make sure LCS handles duplicate sstable added/removed notifications correctly (CASSANDRA-14103)\n * Fix OOM when terminating repair session (CASSANDRA-15902)\n * Avoid marking shutting down nodes as up after receiving gossip shutdown message (CASSANDRA-16094)\n * Check SSTables for latest version before dropping compact storage (CASSANDRA-16063)\n * Handle unexpected columns due to schema races (CASSANDRA-15899)\n * Add flag to ignore unreplicated keyspaces during repair (CASSANDRA-15160)\n * Package tools/bin scripts as executable (CASSANDRA-16151)\n * Fixed a NullPointerException when calling nodetool enablethrift (CASSANDRA-16127)\n * Correctly interpret SASI's `max_compaction_flush_memory_in_mb` setting in megabytes not bytes (CASSANDRA-16071)\n * Fix short read protection for GROUP BY queries (CASSANDRA-15459)\n * Frozen RawTuple is not annotated with frozen in the toString method (CASSANDRA-15857)\nMerged from 3.0:\n * Use IF NOT EXISTS for index and UDT create statements in snapshot schema files (CASSANDRA-13935)\n * Fix gossip shutdown order (CASSANDRA-15816)\n * Remove broken 'defrag-on-read' optimization (CASSANDRA-15432)\n * Check for endpoint collision with hibernating nodes (CASSANDRA-14599)\n * Operational improvements and hardening for replica filtering protection (CASSANDRA-15907)\n * stop_paranoid disk failure policy is ignored on CorruptSSTableException after node is up (CASSANDRA-15191)\n * Forbid altering UDTs used in partition keys (CASSANDRA-15933)\n * Fix empty/null json string representation (CASSANDRA-15896)\n * 3.x fails to start if commit log has range tombstones from a column which is also deleted (CASSANDRA-15970)\n * Handle difference in timestamp precision between java8 and java11 in LogFIle.java (CASSANDRA-16050)\nMerged from 2.2:\n * Fix CQL parsing of collections when the column type is reversed (CASSANDRA-15814)\n * Only allow strings to be passed to JMX authentication (CASSANDRA-16077)\n * Fix cqlsh output when fetching all rows in batch mode (CASSANDRA-15905)\n * Upgrade Jackson to 2.9.10 (CASSANDRA-15867)\n * Fix CQL formatting of read command restrictions for slow query log (CASSANDRA-15503)\n * Allow sstableloader to use SSL on the native port (CASSANDRA-14904)\n * Backport CASSANDRA-12189: escape string literals (CASSANDRA-15948)\n * Avoid hinted handoff per-host throttle being arounded to 0 in large cluster (CASSANDRA-15859)\n * Avoid emitting empty range tombstones from RangeTombstoneList (CASSANDRA-15924)\n * Avoid thread starvation, and improve compare-and-swap performance, in the slab allocators (CASSANDRA-15922)\n * Add token to tombstone warning and error messages (CASSANDRA-15890)\n * Fixed range read concurrency factor computation and capped as 10 times tpc cores (CASSANDRA-15752)\n * Catch exception on bootstrap resume and init native transport (CASSANDRA-15863)\n * Fix replica-side filtering returning stale data with CL \u003e ONE (CASSANDRA-8272, CASSANDRA-8273)\n * Fix duplicated row on 2.x upgrades when multi-rows range tombstones interact with collection ones (CASSANDRA-15805)\n * Rely on snapshotted session infos on StreamResultFuture.maybeComplete to avoid race conditions (CASSANDRA-15667)\n * EmptyType doesn't override writeValue so could attempt to write bytes when expected not to (CASSANDRA-15790)\n * Fix index queries on partition key columns when some partitions contains only static data (CASSANDRA-13666)\n * Avoid creating duplicate rows during major upgrades (CASSANDRA-15789)\n * liveDiskSpaceUsed and totalDiskSpaceUsed get corrupted if IndexSummaryRedistribution gets interrupted (CASSANDRA-15674)\n * Fix Debian init start/stop (CASSANDRA-15770)\n * Fix infinite loop on index query paging in tables with clustering (CASSANDRA-14242)\n * Fix chunk index overflow due to large sstable with small chunk length (CASSANDRA-15595)\n * Allow selecting static column only when querying static index (CASSANDRA-14242)\n * cqlsh return non-zero status when STDIN CQL fails (CASSANDRA-15623)\n * Don't skip sstables in slice queries based only on local min/max/deletion timestamp (CASSANDRA-15690)\n * Memtable memory allocations may deadlock (CASSANDRA-15367)\n * Run evictFromMembership in GossipStage (CASSANDRA-15592)\n * Fix nomenclature of allow and deny lists (CASSANDRA-15862)\n * Remove generated files from source artifact (CASSANDRA-15849)\n * Remove duplicated tools binaries from tarballs (CASSANDRA-15768)\n * Duplicate results with DISTINCT queries in mixed mode (CASSANDRA-15501)\n * Disable JMX rebinding (CASSANDRA-15653)\n * Fix writing of snapshot manifest when the table has table-backed secondary indexes (CASSANDRA-10968)\n * Fix parse error in cqlsh COPY FROM and formatting for map of blobs (CASSANDRA-15679)\n * Fix Commit log replays when static column clustering keys are collections (CASSANDRA-14365)\n * Fix Red Hat init script on newer systemd versions (CASSANDRA-15273)\n * Allow EXTRA_CLASSPATH to work on tar/source installations (CASSANDRA-15567)\n * Fix bad UDT sstable metadata serialization headers written by C* 3.0 on upgrade and in sstablescrub (CASSANDRA-15035)\n * Fix nodetool compactionstats showing extra pending task for TWCS - patch implemented (CASSANDRA-15409)\n * Fix SELECT JSON formatting for the 'duration' type (CASSANDRA-15075)\n * Fix LegacyLayout to have same behavior as 2.x when handling unknown column names (CASSANDRA-15081)\n * Update nodetool help stop output (CASSANDRA-15401)\n * Run in-jvm upgrade dtests in circleci (CASSANDRA-15506)\n * Include updates to static column in mutation size calculations (CASSANDRA-15293)\n * Fix point-in-time recoevery ignoring timestamp of updates to static columns (CASSANDRA-15292)\n * GC logs are also put under $CASSANDRA_LOG_DIR (CASSANDRA-14306)\n * Fix sstabledump's position key value when partitions have multiple rows (CASSANDRA-14721)\n * Avoid over-scanning data directories in LogFile.verify() (CASSANDRA-15364)\n * Bump generations and document changes to system_distributed and system_traces in 3.0, 3.11\n   (CASSANDRA-15441)\n * Fix system_traces creation timestamp; optimise system keyspace upgrades (CASSANDRA-15398)\n * Fix various data directory prefix matching issues (CASSANDRA-13974)\n * Minimize clustering values in metadata collector (CASSANDRA-15400)\n * Avoid over-trimming of results in mixed mode clusters (CASSANDRA-15405)\n * validate value sizes in LegacyLayout (CASSANDRA-15373)\n * Ensure that tracing doesn't break connections in 3.x/4.0 mixed mode by default (CASSANDRA-15385)\n * Make sure index summary redistribution does not start when compactions are paused (CASSANDRA-15265)\n * Ensure legacy rows have primary key livenessinfo when they contain illegal cells (CASSANDRA-15365)\n * Fix race condition when setting bootstrap flags (CASSANDRA-14878)\n * Fix NativeLibrary.tryOpenDirectory callers for Windows (CASSANDRA-15426)\n * Fix SELECT JSON output for empty blobs (CASSANDRA-15435)\n * In-JVM DTest: Set correct internode message version for upgrade test (CASSANDRA-15371)\n * In-JVM DTest: Support NodeTool in dtest (CASSANDRA-15429)\n * Fix NativeLibrary.tryOpenDirectory callers for Windows (CASSANDRA-15426)\n * Fix SASI non-literal string comparisons (range operators) (CASSANDRA-15169)\n * Make sure user defined compaction transactions are always closed (CASSANDRA-15123)\n * Fix cassandra-env.sh to use $CASSANDRA_CONF to find cassandra-jaas.config (CASSANDRA-14305)\n * Fixed nodetool cfstats printing index name twice (CASSANDRA-14903)\n * Add flag to disable SASI indexes, and warnings on creation (CASSANDRA-14866)\n * Add ability to cap max negotiable protocol version (CASSANDRA-15193)\n * Gossip tokens on startup if available (CASSANDRA-15335)\n * Fix resource leak in CompressedSequentialWriter (CASSANDRA-15340)\n * Fix bad merge that reverted CASSANDRA-14993 (CASSANDRA-15289)\n * Fix LegacyLayout RangeTombstoneList IndexOutOfBoundsException when upgrading and RangeTombstone bounds are asymmetric (CASSANDRA-15172)\n * Fix NPE when using allocate_tokens_for_keyspace on new DC/rack (CASSANDRA-14952)\n * Filter sstables earlier when running cleanup (CASSANDRA-15100)\n * Use mean row count instead of mean column count for index selectivity calculation (CASSANDRA-15259)\n * Avoid updating unchanged gossip states (CASSANDRA-15097)\n * Prevent recreation of previously dropped columns with a different kind (CASSANDRA-14948)\n * Prevent client requests from blocking on executor task queue (CASSANDRA-15013)\n * Toughen up column drop/recreate type validations (CASSANDRA-15204)\n * LegacyLayout should handle paging states that cross a collection column (CASSANDRA-15201)\n * Prevent RuntimeException when username or password is empty/null (CASSANDRA-15198)\n * Multiget thrift query returns null records after digest mismatch (CASSANDRA-14812)\n * Skipping illegal legacy cells can break reverse iteration of indexed partitions (CASSANDRA-15178)\n * Handle paging states serialized with a different version than the session's (CASSANDRA-15176)\n * Throw IOE instead of asserting on unsupporter peer versions (CASSANDRA-15066)\n * Update token metadata when handling MOVING/REMOVING_TOKEN events (CASSANDRA-15120)\n * Add ability to customize cassandra log directory using $CASSANDRA_LOG_DIR (CASSANDRA-15090)\n * Skip cells with illegal column names when reading legacy sstables (CASSANDRA-15086)\n * Fix assorted gossip races and add related runtime checks (CASSANDRA-15059)\n * Fix mixed mode partition range scans with limit (CASSANDRA-15072)\n * cassandra-stress works with frozen collections: list and set (CASSANDRA-14907)\n * Fix handling FS errors on writing and reading flat files - LogTransaction and hints (CASSANDRA-15053)\n * Avoid double closing the iterator to avoid overcounting the number of requests (CASSANDRA-15058)\n * Improve `nodetool status -r` speed (CASSANDRA-14847)\n * Improve merkle tree size and time on heap (CASSANDRA-14096)\n * Add missing commands to nodetool_completion (CASSANDRA-14916)\n * Anti-compaction temporarily corrupts sstable state for readers (CASSANDRA-15004)\n * Catch non-IOException in FileUtils.close to make sure that all resources are closed (CASSANDRA-15225)\n * Handle exceptions during authentication/authorization (CASSANDRA-15041)\n * Support cross version messaging in in-jvm upgrade dtests (CASSANDRA-15078)\n * Fix index summary redistribution cancellation (CASSANDRA-15045)\n * Fixing invalid CQL in security documentation (CASSANDRA-15020)\n * Allow instance class loaders to be garbage collected for inJVM dtest (CASSANDRA-15170)\n * Add support for network topology and query tracing for inJVM dtest (CASSANDRA-15319)\n * Correct sstable sorting for garbagecollect and levelled compaction (CASSANDRA-14870)\n * Severe concurrency issues in STCS,DTCS,TWCS,TMD.Topology,TypeParser\n * Add a script to make running the cqlsh tests in cassandra repo easier (CASSANDRA-14951)\n * If SizeEstimatesRecorder misses a 'onDropTable' notification, the size_estimates table will never be cleared for that table. (CASSANDRA-14905)\n * Counters fail to increment in 2.1/2.2 to 3.X mixed version clusters (CASSANDRA-14958)\n * Streaming needs to synchronise access to LifecycleTransaction (CASSANDRA-14554)\n * Fix cassandra-stress write hang with default options (CASSANDRA-14616)\n * Differentiate between slices and RTs when decoding legacy bounds (CASSANDRA-14919)\n * Netty epoll IOExceptions caused by unclean client disconnects being logged at INFO (CASSANDRA-14909)\n * Unfiltered.isEmpty conflicts with Row extends AbstractCollection.isEmpty (CASSANDRA-14588)\n * RangeTombstoneList doesn't properly clean up mergeable or superseded rts in some cases (CASSANDRA-14894)\n * Fix handling of collection tombstones for dropped columns from legacy sstables (CASSANDRA-14912)\n * Throw exception if Columns serialized subset encode more columns than possible (CASSANDRA-14591)\n * Drop/add column name with different Kind can result in corruption (CASSANDRA-14843)\n * Fix missing rows when reading 2.1 SSTables with static columns in 3.0 (CASSANDRA-14873)\n * Move TWCS message 'No compaction necessary for bucket size' to Trace level (CASSANDRA-14884)\n * Sstable min/max metadata can cause data loss (CASSANDRA-14861)\n * Dropped columns can cause reverse sstable iteration to return prematurely (CASSANDRA-14838)\n * Legacy sstables with  multi block range tombstones create invalid bound sequences (CASSANDRA-14823)\n * Expand range tombstone validation checks to multiple interim request stages (CASSANDRA-14824)\n * Reverse order reads can return incomplete results (CASSANDRA-14803)\n * Avoid calling iter.next() in a loop when notifying indexers about range tombstones (CASSANDRA-14794)\n * Fix purging semi-expired RT boundaries in reversed iterators (CASSANDRA-14672)\n * DESC order reads can fail to return the last Unfiltered in the partition (CASSANDRA-14766)\n * Fix corrupted collection deletions for dropped columns in 3.0 \u003c-\u003e  2.{1,2} messages (CASSANDRA-14568)\n * Fix corrupted static collection deletions in 3.0 \u003c-\u003e 2.{1,2} messages (CASSANDRA-14568)\n * Handle failures in parallelAllSSTableOperation (cleanup/upgradesstables/etc) (CASSANDRA-14657)\n * Improve TokenMetaData cache populating performance avoid long locking (CASSANDRA-14660)\n * Backport: Flush netty client messages immediately (not by default) (CASSANDRA-13651)\n * Fix static column order for SELECT * wildcard queries (CASSANDRA-14638)\n * sstableloader should use discovered broadcast address to connect intra-cluster (CASSANDRA-14522)\n * Fix reading columns with non-UTF names from schema (CASSANDRA-14468)\n * Don't enable client transports when bootstrap is pending (CASSANDRA-14525)\n * MigrationManager attempts to pull schema from different major version nodes (CASSANDRA-14928)\n * Fix incorrect cqlsh results when selecting same columns multiple times (CASSANDRA-13262)\n * Returns null instead of NaN or Infinity in JSON strings (CASSANDRA-14377)\n * Paged Range Slice queries with DISTINCT can drop rows from results (CASSANDRA-14956)\n\nChanges in crowbar-openstack:\n- Update to version 6.0+git.1616146717.a89ae0f4e:\n  * monasca: restart Kibana on update (bsc#1044849)\n\nChanges in grafana\n- Add CVE-2021-27358.patch (bsc#1183803, CVE-2021-27358)\n  * Prevent unauthenticated remote attackers from causing a DoS through the\n    snapshots API.\n\nChanges in kibana:\n- Ensure /etc/sysconfig/kibana is present\n\n- Update to Kibana 4.6.6 (bsc#1044849, CVE-2017-11499, ESA-2017-14, ESA-2017-16)\n  * [4.6] ignore forked code for babel transpile build phase (#13483)\n  * Allow more than match queries in custom filters (#8614) (#10857)\n  * [state] don't make extra $location.replace() calls (#9954)\n  * [optimizer] move to querystring-browser package for up-to-date api\n  * [state/unhashUrl] use encode-uri-query to generate cleanly encoded urls\n  * server: refactor log_interceptor to be more DRY (#9617)\n  * server: downgrade ECANCELED logs to debug (#9616)\n  * server: do not treat logged warnings as errors (#8746) (#9610)\n  * [server/logger] downgrade EPIPE errors to debug level (#9023)\n  * Add basepath when redirecting from a trailling slash (#9035)\n  * [es/kibanaIndex] use unmapped_type rather than ignore_unmapped (#8968)\n  * [server/shortUrl] validate urls before shortening them\n- Add CVE-2017-11481.patch (bsc#1044849, CVE-2017-11481)\n  * This fixes an XSS vulnerability in URL fields\n- Remove %dir declaration from /opt/kibana/optimize to ensure\n  no files owned by root end up in there\n- Exclude /opt/kibana/optimize from %fdupes\n- Restart service on upgrade\n- Do not copy LICENSE.txt and README.txt to /opt/kibana\n- Fix rpmlint warnings/errors\n- Switch to explicit patch application\n- Fix source URL\n- Fix logic for systemd/systemv detection\n\n- Add 0001-Configurable-custom-response-headers-for-server.patch\n  (bsc#1171909, CVE-2020-10743)\n\n- Added kibana.yml symlink (bsc#1048688, FATE#323204)\nChanges in openstack-dashboard:\n- Update to version horizon-14.1.1.dev11:\n  * Consume tempest-horizon from PyPI release\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev17:\n  * Remove lower-constraints job\n\nChanges in openstack-ironic:\n- Update to version ironic-11.1.5.dev17:\n  * Remove lower-constraints job\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev164:\n  * Schedule networks to new segments if needed\n\n- Update to version neutron-13.0.8.dev162:\n  * Fix invalid JSON generated by quota details\n\n- Update to version neutron-13.0.8.dev160:\n  * Fix deletion of rfp interfaces when router is re-enabled\n\n- Update to version neutron-13.0.8.dev159:\n  * [OVS FW] Allow egress ICMPv6 only for know addresses\n  * [OVS FW] Clean conntrack entries with mark == CT\\_MARK\\_INVALID\n\n- Update to version neutron-13.0.8.dev155:\n  * Fix removal of dvr-src mac flows when non-gateway port on router is deleted\n\n- Update to version neutron-13.0.8.dev153:\n  * Add some wait time between stopping and starting again ovsdb monitor\n  * Workaround for TCP checksum issue with ovs-dpdk and  veth pair\n\n- Update to version neutron-13.0.8.dev149:\n  * Fix wrong packet\\_type set for IPv6 GRE tunnels in OVS\n\n- Update to version neutron-13.0.8.dev148:\n  * Fix losses of ovs flows when ovs is restarted\n\nChanges in openstack-neutron:\n- Update to version neutron-13.0.8.dev164:\n  * Schedule networks to new segments if needed\n\n- Update to version neutron-13.0.8.dev162:\n  * Fix invalid JSON generated by quota details\n\n- Update to version neutron-13.0.8.dev160:\n  * Fix deletion of rfp interfaces when router is re-enabled\n\n- Update to version neutron-13.0.8.dev159:\n  * [OVS FW] Allow egress ICMPv6 only for know addresses\n  * [OVS FW] Clean conntrack entries with mark == CT\\_MARK\\_INVALID\n\n- Update to version neutron-13.0.8.dev155:\n  * Fix removal of dvr-src mac flows when non-gateway port on router is deleted\n\n- Update to version neutron-13.0.8.dev153:\n  * Add some wait time between stopping and starting again ovsdb monitor\n  * Workaround for TCP checksum issue with ovs-dpdk and  veth pair\n\n- Update to version neutron-13.0.8.dev149:\n  * Fix wrong packet\\_type set for IPv6 GRE tunnels in OVS\n\n- Update to version neutron-13.0.8.dev148:\n  * Fix losses of ovs flows when ovs is restarted\n\nChanges in openstack-neutron-gbp:\n- Update to version group-based-policy-12.0.1.dev29:\n  * gbp-validate: Tenant and resource level scoping\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev27:\n  * Import data\\_utils from the new location\n\n- Update to version group-based-policy-12.0.1.dev26:\n  * Add SNAT port's Mac Address to the host\\_snat\\_ips dictionary\n\n- Update to version group-based-policy-12.0.1.dev25:\n  * Add support for victoria\n  2014.2.rc1\n\n- Update to version group-based-policy-12.0.1.dev24:\n  * Fix deletion of SVI networks\n\n- Update to version group-based-policy-12.0.1.dev23:\n  * Allow per-port qos configuration on dhcp port\n  2014.2rc1\n\n- Update to version group-based-policy-12.0.1.dev22:\n  * Add connectivity parameter to driver\n  * [AIM] Fix ERSPAN extension\n  2014.2.rc1\n\n- Update to version group-based-policy-12.0.1.dev19:\n  * Fix exception with cleanup\n  2014.2.0rc1\n\n- Update to version group-based-policy-12.0.1.dev18:\n  * Add workaround to get\\_subnets\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev82:\n  * [stable-only] gate: Pin CEPH\\_RELEASE to nautilus in LM hook\n  * Change default num\\_retries for glance to 3\n\nChanges in openstack-nova:\n- Update to version nova-18.3.1.dev82:\n  * [stable-only] gate: Pin CEPH\\_RELEASE to nautilus in LM hook\n  * Change default num\\_retries for glance to 3\n\nChanges in python-Django1:\n- Add CVE-2021-33203.patch (bsc#1186608, CVE-2021-33203)\n    * Fixed potential path-traversal via admindocs' TemplateDetailView.\n- Add CVE-2021-33571.patch (bsc#1186611, CVE-2021-33571)\n    * Prevented leading zeros in IPv4 addresses.\n\n- Add CVE-2021-31542.patch (bsc#1185623, CVE-2021-31542)\n    * Fixed CVE-2021-31542 -- Tightened path and file name sanitation in file\n      uploads.\n\n- Add CVE-2021-28658.patch (bsc#1184148, CVE-2021-28658)\n  * Fixed potential directory-traversal via uploaded files\n\n- Add CVE-2021-23336.patch (bsc#1182433, CVE-2021-23336)\n  * Fixed web cache poisoning via django.utils.http.limited_parse_qsl()\n\n\nChanges in python-py:\n- Add CVE-2020-29651.patch ((bsc#1179805, CVE-2020-29651)\n  * svnwc: fix regular expression vulnerable to DoS in blame\n    functionality\n\nChanges in python-pysaml2:\n- Fix patches (SOC-11453)\n  * 0005-Fix-CVE-2021-21238-SAML-XML-Signature-wrapping.patch\n     - rename saml2.xml to saml2.samlxml to avoid overriding\n       the xml module in the system module path\n     - add missing __init__.py files\n     - add missing saml2/data package to setup.py\n  * 0007-Make-previous-commits-python2-compatible.patch so as not to\n     - Adjust to saml2.xml to saml2.samlxml changes\n     - Fix a few more syntax errors and Python2-isms.\n\n- Fix CVE-2021-21238, bsc#1181277 with\n  0002-Strengthen-XSW-tests.patch ,\n  0003-Fix-the-parser-to-not-break-on-ePTID-AttributeValues.patch ,\n  0004-Add-xsd-schemas.patch ,\n  0005-Fix-CVE-2021-21238-SAML-XML-Signature-wrapping.patch .\n  This adds a dependency on python-xmlschema, which depends on\n  python-elementpath, thus both need to be added for this to work.\n  The used python-xmlschema needs to support the sandbox argument\n  which was added in 1.2.0 and refined in 1.2.1, but that version\n  doesn't support python2, so a patched version that does both is\n  needed.\n  Add 0007-Make-previous-commits-python2-compatible.patch to\n  not add a dependency on reportlib_resources and make other\n  changes python2 compatible.\n. Fix CVE-2021-21239, bsc#1181278 with\n  0006-Fix-CVE-2021-21239-Restrict-the-key-data-that-xmlsec.patch\n\nChanges in python-xmlschema:\n\n- Add 3 patches to backport sandbox argument, which is needed by a security fix\n  in python-pysaml2 and one patch to make backport python2 compatible.\n- Upstream url changed\n- Add rpmlintrc to make it work on Leap 42.3\n- Update to 1.0.18:\n  * Fix for *ModelVisitor.iter_unordered_content()*\n  * Fixed default converter, AbderaConverter and JsonMLConverter for xs:anyType decode\n  * Fixed validation tests with all converters\n  * Added UnorderedConverter to validation tests\n- Update to 1.0.17:\n  * Enhancement of validation-only speed (~15%)\n  * Added *is_valid()* and *iter_errors()* to module API\n- Update to 1.0.16:\n  * Improved XMLResource class for working with compressed files\n  * Fix for validation with XSD wildcards and 'lax' process content\n  * Fix ambiguous items validation for xs:choice and xs:sequence models\n\n- Handle UnicodeDecodeErrors during build process\n\n- Update to 1.0.15:\n  * Improved XPath 2.0 bindings\n  * Added logging for schema initialization and building (handled with argument loglevel)\n  * Update encoding of collapsed contents with a new model based reordering method\n  * Removed XLink namespace from meta-schema (loaded from a fallback location like XHTML)\n  * Fixed half of failed W3C instance tests (remain 255 over 15344 tests)\n\n- Initial commit, needed by pytest 5.1.2\nChanges in python-elementpath:\n\n- Update to 1.3.1:\n  * Improved schema proxy\n  * Improved XSD type matching using paths\n  * Cached parent path for XPathContext (only Python 3)\n  * Improve typed selection with TypedAttribute and TypedElement named-tuples\n  * Add iter_results to XPathContext\n  * Remove XMLSchemaProxy from package\n  * Fix descendant shortcut operator '//'\n  * Fix text() function\n  * Fix typed select of '(name)' token\n  * Fix 24-hour time for DateTime\n\n- Skip test_hashing to fix 32bit builds\n\n- Initial commit needed by python-xmlschema\nChanges in rubygem-activerecord-session_store:\n- added CVE-2019-25025.patch (CVE-2019-25025, bsc#1183174)\n  * This requires CVE-2019-16782.patch to be included in\n    rubygem-actionpack-4_2 to work correctly.\n\nChanges in venv-openstack-keystone\n- Add python-xmlschema and python-elementpath for new python-pysaml2 version.\n","status":"published","published":"2021-06-11T13:13:53Z","modified":"2026-02-04T03:22:05.167952Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}