{"id":"CVE-2023-6152","aliases":["BIT-grafana-2023-6152","EUVD-2024-0487","GHSA-3hv4-r2fm-h27f","SUSE-SU-2024:1419-1","SUSE-SU-2024:1427-1","SUSE-SU-2024:1508-1","SUSE-SU-2024:1509-1","SUSE-SU-2024:1530-1","SUSE-SU-2024:1530-2","SUSE-SU-2025:0524-1","SUSE-SU-2025:0525-1","SUSE-SU-2025:0545-1","UBUNTU-CVE-2023-6152","openSUSE-SU-2024:13713-1"],"status":"published","title":"Email Validation Bypass And Preventing Sign Up From Email's Owner","description":"A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01385,"percentile":0.72409,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2024-02-13T21:38:01Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Go","package":"github.com/grafana/grafana","fixed_in":["9.5.16","10.0.11","10.1.7","10.2.4","10.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"grafana","fixed_in":["9.5.16","10.0.11","10.1.7","10.2.4","10.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"golang-github-prometheus-alertmanager","fixed_in":["0.26.0-4.18.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"golang-github-prometheus-node_exporter","fixed_in":["1.7.0-4.18.2"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"golang-github-prometheus-promu","fixed_in":["0.14.0-4.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"grafana","fixed_in":["9.5.16-4.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"spacecmd","fixed_in":["5.0.5-41.48.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"spacewalk-client-tools","fixed_in":["5.0.4-55.51.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"supportutils-plugin-susemanager-client","fixed_in":["5.0.3-9.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"uyuni-tools","fixed_in":["0.1.7-3.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"grafana","fixed_in":["10.1.7-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"9.5.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.11"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0"},{"fixed":"10.1.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.2.0"},{"fixed":"10.2.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.3.0"},{"fixed":"10.3.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"2.5.0"},{"fixed":"9.5.16"},{"introduced":"10.0.0"},{"fixed":"10.0.11"},{"introduced":"10.1.0"},{"fixed":"10.1.7"},{"introduced":"10.2.0"},{"fixed":"10.2.4"},{"introduced":"10.3.0"},{"fixed":"10.3.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"2.5.0"},{"fixed":"9.5.16"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"10.0.0"},{"fixed":"10.0.11"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"10.1.0"},{"fixed":"10.1.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"10.2.0"},{"fixed":"10.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/grafana/grafana","ranges":[{"type":"SEMVER","events":[{"introduced":"10.3.0"},{"fixed":"10.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-4.18.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-4.18.2"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-4.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.16-4.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-41.48.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-55.51.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-9.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12-BETA","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-3.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"POS_Image-Graphical7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-159000.3.24.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"POS_Image-JeOS7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-159000.3.24.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.27-159000.3.12.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-159000.3.33.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.16-159000.4.30.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5-159000.6.48.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-159000.6.54.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.3-159000.6.21.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15-BETA","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-159000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools Beta for SLE Micro 5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-159000.6.2.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools Beta for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.7-159000.3.8.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0-1.27.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.30.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-1.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.18-1.63.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-1.47.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-38.139.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-52.98.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacewalk-koan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-24.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-1.39.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.30.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.30.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"POS_Image-Graphical7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-150000.1.21.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"POS_Image-JeOS7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-150000.1.21.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.27-150000.1.17.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-150000.1.53.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.18-150000.1.63.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"mgr-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.9-150000.1.47.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-150000.3.116.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.19-150000.3.89.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacewalk-koan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-150000.3.33.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-common-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-150000.1.39.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150000.1.21.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-150000.1.53.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150000.1.21.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-150000.3.18.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.27-150000.1.17.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Manager Proxy Module 4.3","package":"uyuni-proxy-systemd-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.12-150000.1.21.2"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"POS_Image-Graphical7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-150000.1.21.2"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"POS_Image-JeOS7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-150000.1.21.2"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.27-150000.1.17.2"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1710765237.46af599-150000.1.53.2"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.14.0-150000.3.18.2"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.27-150000.3.116.2"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.18-150200.3.56.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.18-150200.3.56.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"mybatis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.6-150200.5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.18-150200.3.56.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.5.18-150200.3.56.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"mybatis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.6-150200.5.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.3-1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-1.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-1.66.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-38.153.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-6.25.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-6.33.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.28-1.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1728559936.c16d4fb-150000.1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.53.3-150000.3.59.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-150000.1.66.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-150000.3.130.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-150000.3.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.28-150000.1.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1728559936.c16d4fb-150000.1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Client Tools for SLE Micro 5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.28-150000.1.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"dracut-saltboot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1728559936.c16d4fb-150000.1.56.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"golang-github-prometheus-promu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.0-150000.3.24.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.11-150000.3.130.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"supportutils-plugin-salt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-150000.3.16.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"supportutils-plugin-susemanager-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4-150000.3.27.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-150200.3.59.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.13-150200.3.59.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0+dfsg-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.7-1.1"}]}]}],"products":[{"vendor":"grafana","product":"grafana"},{"vendor":"grafana","product":"grafana enterprise"},{"vendor":"grafana","product":"grafana_enterprise"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2023-6152/","tags":["x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://github.com/grafana/bugbounty/security/advisories/GHSA-3hv4-r2fm-h27f","tags":["x_transferred","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250214-0008/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6152","tags":["web","advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2023-6152","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250214-0008","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3hv4-r2fm-h27f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6152.json","tags":["advisory"]},{"url":"https://github.com/grafana/grafana","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241419-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219887","tags":["report"]},{"url":"https://bugzilla.suse.com/1219912","tags":["report"]},{"url":"https://bugzilla.suse.com/1220371","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6152","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241427-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008037","tags":["report"]},{"url":"https://bugzilla.suse.com/1008038","tags":["report"]},{"url":"https://bugzilla.suse.com/1010940","tags":["report"]},{"url":"https://bugzilla.suse.com/1019021","tags":["report"]},{"url":"https://bugzilla.suse.com/1038785","tags":["report"]},{"url":"https://bugzilla.suse.com/1059235","tags":["report"]},{"url":"https://bugzilla.suse.com/1099805","tags":["report"]},{"url":"https://bugzilla.suse.com/1166389","tags":["report"]},{"url":"https://bugzilla.suse.com/1171823","tags":["report"]},{"url":"https://bugzilla.suse.com/1174145","tags":["report"]},{"url":"https://bugzilla.suse.com/1174302","tags":["report"]},{"url":"https://bugzilla.suse.com/1175993","tags":["report"]},{"url":"https://bugzilla.suse.com/1177948","tags":["report"]},{"url":"https://bugzilla.suse.com/1216854","tags":["report"]},{"url":"https://bugzilla.suse.com/1219002","tags":["report"]},{"url":"https://bugzilla.suse.com/1221092","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9587","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0690","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241508-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221465","tags":["report"]},{"url":"https://bugzilla.suse.com/1222155","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-1313","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241509-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8628","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1753","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241530-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241530-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250524-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1212641","tags":["report"]},{"url":"https://bugzilla.suse.com/1229079","tags":["report"]},{"url":"https://bugzilla.suse.com/1229104","tags":["report"]},{"url":"https://bugzilla.suse.com/1231024","tags":["report"]},{"url":"https://bugzilla.suse.com/1231497","tags":["report"]},{"url":"https://bugzilla.suse.com/1231568","tags":["report"]},{"url":"https://bugzilla.suse.com/1231759","tags":["report"]},{"url":"https://bugzilla.suse.com/1232575","tags":["report"]},{"url":"https://bugzilla.suse.com/1232769","tags":["report"]},{"url":"https://bugzilla.suse.com/1232817","tags":["report"]},{"url":"https://bugzilla.suse.com/1232970","tags":["report"]},{"url":"https://bugzilla.suse.com/1233202","tags":["report"]},{"url":"https://bugzilla.suse.com/1233279","tags":["report"]},{"url":"https://bugzilla.suse.com/1233630","tags":["report"]},{"url":"https://bugzilla.suse.com/1233660","tags":["report"]},{"url":"https://bugzilla.suse.com/1234123","tags":["report"]},{"url":"https://bugzilla.suse.com/1234554","tags":["report"]},{"url":"https://bugzilla.suse.com/1235145","tags":["report"]},{"url":"https://bugzilla.suse.com/1236301","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8118","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250545-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-6152","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6152","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-6152","description":"A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.\n\n","status":"published","published":"2024-02-13T21:38:01.404Z","modified":"2025-02-15T00:10:28.89Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2024-0487","description":"A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.\n\n","status":"published","published":"2024-02-13T21:38:01Z","modified":"2025-02-15T00:10:28Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:29.822486Z"}],"ghsa":[{"id":"GHSA-3hv4-r2fm-h27f","title":"Email Validation Bypass And Preventing Sign Up From Email's Owner","description":"### Summary\nEmail validation can easily be bypassed because `verify_email_enabled` option enable email validation at sign up only.\nA user changing it's email after signing up (and verifying it) can change it without verification in `/profile`.\nThis can be used to prevent legitimate owner of the email address from signing up.\n\nAnother way to prevent email's owner from signing up is by setting Username as an email:\nWhen a new user is registrering, they can set two different email addresses in the Email and Username field, technically having 2 email addresses (because Grafana handles usernames and emails the same in some situations), but only the former is validated.\n\n![](https://user-images.githubusercontent.com/44581623/282073913-c1a8c20b-b6c3-46eb-840c-9e0dae718a2a.png)\n\nHere user a prevents owner of bar@example.com to signup.\n\n### Details\nI don't know exact location but this is related to PUT /api/user handler.\n\n### PoC\nBypass email validation:\n* Start a new grafana instance using latest version\n* Sign up with email foo@example.\n* Login to that account.\n* Go to profile and change email to  bar@example.com\n* That's it, your using an email you don't own.\n\nPrevent email's owner from signing up:\n* Start a new grafana instance using latest version\n* Sign up with email foo@example.\n* Login to that account.\n* Go to profile and change username (not email) to [bar@example.com](mailto:bar@example.com)\n* Signout.\n* Try to sign up with email [b@example.com](mailto:b@example.com)\n* Warning popup \"User with same email address already exists\"\n\nK6 script (with `verify_email_enabled` set to `false`):\n```js\nimport { check, group } from \"k6\"\nimport http from \"k6/http\"\n\nexport const options = {\n  scenarios: {\n    perVuIter: {\n      executor: 'per-vu-iterations',\n      vus: 1,\n      iterations: 1\n    }\n  }\n}\n\nconst GRAFANA_URL = __ENV.GRAFANA_URL || \"http://localhost:3000\"\n\nexport default function () {\n  group(\"create user_a with email foo@example.com\", () =\u003e {\n    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({\n      \"email\": \"foo@example.com\",\n      \"password\": \"password\"\n    }), {\n      headers: {\n        'Content-Type': \"application/json\"\n      }\n    })\n\n    check(response, {\n      'status code is 200': (r) =\u003e r.status == 200\n    })\n  })\n\n  group(\"change user_a login to bar@example.com\", () =\u003e {\n    const response = http.put(`${GRAFANA_URL}/api/user`, JSON.stringify({\n      \"email\": \"foo@example.com\",\n      \"login\": \"bar@example.com\", // user_b email.\n    }), {\n      headers: {\n        'Content-Type': \"application/json\"\n      }\n    })\n\n    check(response, {\n      'status code is 200': (r) =\u003e r.status == 200\n    })\n  })\n\n  http.cookieJar().clear(GRAFANA_URL)\n\n  group(\"create user_b with email bar@example.com\", () =\u003e {\n    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({\n      \"email\": \"bar@example.com\",\n      \"username\": \"bar@example.com\",\n      \"password\": \"password\"\n    }), {\n      headers: {\n        'Content-Type': \"application/json\"\n      }\n    })\n\n    check(response, {\n      'status code is 200': (r) =\u003e r.status == 200 // fail\n    })\n  })\n}\n```\n\n### Impact\nBypass email verification.\nPrevent legitimate owner from signing up.","status":"published","published":"2024-02-13T22:25:10Z","modified":"2025-02-18T22:29:37Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:38:32.275316Z"}],"nvd":[{"id":"CVE-2023-6152","description":"A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.\n\n","status":"published","published":"2024-02-13T22:15:45.43Z","modified":"2026-06-17T06:50:09.507Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:09:04.527564Z"}],"osv":[{"id":"CVE-2023-6152","description":"A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.\n\n","status":"published","published":"2024-02-13T21:38:01.404Z","modified":"2026-10-28T02:30:40.13877833Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"GHSA-3hv4-r2fm-h27f","title":"Email Validation Bypass And Preventing Sign Up From Email's Owner","description":"### Summary\nEmail validation can easily be bypassed because `verify_email_enabled` option enable email validation at sign up only.\nA user changing it's email after signing up (and verifying it) can change it without verification in `/profile`.\nThis can be used to prevent legitimate owner of the email address from signing up.\n\nAnother way to prevent email's owner from signing up is by setting Username as an email:\nWhen a new user is registrering, they can set two different email addresses in the Email and Username field, technically having 2 email addresses (because Grafana handles usernames and emails the same in some situations), but only the former is validated.\n\n![](https://user-images.githubusercontent.com/44581623/282073913-c1a8c20b-b6c3-46eb-840c-9e0dae718a2a.png)\n\nHere user a prevents owner of bar@example.com to signup.\n\n### Details\nI don't know exact location but this is related to PUT /api/user handler.\n\n### PoC\nBypass email validation:\n* Start a new grafana instance using latest version\n* Sign up with email foo@example.\n* Login to that account.\n* Go to profile and change email to  bar@example.com\n* That's it, your using an email you don't own.\n\nPrevent email's owner from signing up:\n* Start a new grafana instance using latest version\n* Sign up with email foo@example.\n* Login to that account.\n* Go to profile and change username (not email) to [bar@example.com](mailto:bar@example.com)\n* Signout.\n* Try to sign up with email [b@example.com](mailto:b@example.com)\n* Warning popup \"User with same email address already exists\"\n\nK6 script (with `verify_email_enabled` set to `false`):\n```js\nimport { check, group } from \"k6\"\nimport http from \"k6/http\"\n\nexport const options = {\n  scenarios: {\n    perVuIter: {\n      executor: 'per-vu-iterations',\n      vus: 1,\n      iterations: 1\n    }\n  }\n}\n\nconst GRAFANA_URL = __ENV.GRAFANA_URL || \"http://localhost:3000\"\n\nexport default function () {\n  group(\"create user_a with email foo@example.com\", () =\u003e {\n    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({\n      \"email\": \"foo@example.com\",\n      \"password\": \"password\"\n    }), {\n      headers: {\n        'Content-Type': \"application/json\"\n      }\n    })\n\n    check(response, {\n      'status code is 200': (r) =\u003e r.status == 200\n    })\n  })\n\n  group(\"change user_a login to bar@example.com\", () =\u003e {\n    const response = http.put(`${GRAFANA_URL}/api/user`, JSON.stringify({\n      \"email\": \"foo@example.com\",\n      \"login\": \"bar@example.com\", // user_b email.\n    }), {\n      headers: {\n        'Content-Type': \"application/json\"\n      }\n    })\n\n    check(response, {\n      'status code is 200': (r) =\u003e r.status == 200\n    })\n  })\n\n  http.cookieJar().clear(GRAFANA_URL)\n\n  group(\"create user_b with email bar@example.com\", () =\u003e {\n    const response = http.post(`${GRAFANA_URL}/api/user/signup/step2`, JSON.stringify({\n      \"email\": \"bar@example.com\",\n      \"username\": \"bar@example.com\",\n      \"password\": \"password\"\n    }), {\n      headers: {\n        'Content-Type': \"application/json\"\n      }\n    })\n\n    check(response, {\n      'status code is 200': (r) =\u003e r.status == 200 // fail\n    })\n  })\n}\n```\n\n### Impact\nBypass email verification.\nPrevent legitimate owner from signing up.","status":"published","published":"2024-02-13T22:25:10Z","modified":"2026-08-07T08:12:23.832138912Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"UBUNTU-CVE-2023-6152","description":"A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option \"verify_email_enabled\" will only validate email only on sign up.","status":"published","published":"2024-02-13T22:15:00Z","modified":"2025-10-24T05:01:37Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"BIT-grafana-2023-6152","description":"A user changing their email after signing up and verifying it can change it without verification in profile settings.\n\nThe configuration option \"verify_email_enabled\" will only validate email only on sign up.","status":"published","published":"2024-03-12T08:24:38.577Z","modified":"2026-09-08T08:47:51.235759292Z","updated_at":"2026-11-02T15:28:31.02759Z"},{"id":"openSUSE-SU-2024:13713-1","title":"grafana-10.1.7-1.1 on GA media","description":"These are all security issues fixed in the grafana-10.1.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:15:33.416032Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2024:1419-1","title":"Security Beta update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- Use %patch -P N instead of deprecated %patchN\n\ngolang-github-prometheus-node_exporter:\n\n- Add `device_error` label for filesystem metrics.\n- Update rtnetlink library to fix errors during ARP metrics collection.\n- Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):\n  * [FEATURE] Add ZFS freebsd per dataset stats #2753\n  * [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721\n  * [ENHANCEMENT] Parallelize stat calls in Linux filesystem\n    collector #1772\n  * [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711\n  * [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric\n    #2778\n  * [ENHANCEMENT] Improve qdisc collector performance #2779\n  * [ENHANCEMENT] Add include and exclude filter for hwmon\n    collector #2699\n  * [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead\n    of procfs #2777\n  * [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754\n  * [BUGFIX] Fallback to 32-bit stats in netdev #2757\n  * [BUGFIX] Close btrfs.FS handle after use #2780\n  * [BUGFIX] Move RO status before error return #2807\n  * [BUFFIX] Fix promhttp_metric_handler_errors_total being always\n    active #2808\n  * [BUGFIX] Fix nfsd v4 index miss #2824\n- Update to 1.6.1:\n  (no source code changes in this release)\n- BuildRequire go1.20\n- Update to 1.6.0:\n  * [CHANGE] Fix cpustat when some cpus are offline #2318\n  * [CHANGE] Remove metrics of offline CPUs in CPU collector #2605\n  * [CHANGE] Deprecate ntp collector #2603\n  * [CHANGE] Remove bcache `cache_readaheads_totals` metrics #2583\n  * [CHANGE] Deprecate supervisord collector #2685\n  * [FEATURE] Enable uname collector on NetBSD #2559\n  * [FEATURE] NetBSD support for the meminfo collector #2570\n  * [FEATURE] NetBSD support for CPU collector #2626\n  * [FEATURE] Add FreeBSD collector for netisr subsystem #2668\n  * [FEATURE] Add softirqs collector #2669\n  * [ENHANCEMENT] Add suspended as a `node_zfs_zpool_state` #2449\n  * [ENHANCEMENT] Add administrative state of Linux network\n    interfaces #2515\n  * [ENHANCEMENT] Log current value of GOMAXPROCS #2537\n  * [ENHANCEMENT] Add profiler options for perf collector #2542\n  * [ENHANCEMENT] Allow root path as metrics path #2590\n  * [ENHANCEMENT] Add cpu frequency governor metrics #2569\n  * [ENHANCEMENT] Add new landing page #2622\n  * [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634\n  * [ENHANCEMENT] Add ZFS `memory_available_bytes` #2687\n  * [ENHANCEMENT] Use `SCSI_IDENT_SERIAL` as serial in diskstats #2612\n  * [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669\n  * [BUGFIX] perf: fixes for automatically detecting the correct\n    tracefs mountpoints #2553\n  * [BUGFIX] Fix `thermal_zone` collector noise @2554\n  * [BUGFIX] Fix a problem fetching the user wire count on FreeBSD\n    2584\n  * [BUGFIX] interrupts: Fix fields on linux aarch64 #2631\n  * [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605\n  * [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637\n  * [BUGFIX] Fix bad reporting of `node_cpu_seconds_total` in\n    OpenBSD #2663\n- Change go_modules archive in _service to use obscpio file\n\ngolang-github-prometheus-promu:\n\n- Don't pass -extldflags -static by default\n\ngrafana:\n\n- Require Go 1.20\n- Update to version 9.5.16:\n  * [SECURITY] CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n  * [BUGFIX] Annotations: Split cleanup into separate queries and\n    deletes to avoid deadlocks on MySQL\n- Update to version 9.5.15:\n  * [FEATURE] Alerting: Attempt to retry retryable errors\n- Update to version 9.5.14:\n  * [BUGFIX] Alerting: Fix state manager to not keep\n    datasource_uid and ref_id labels in state after Error\n  * [BUGFIX] Transformations: Config overrides being lost when\n    config from query transform is applied\n  * [BUGFIX] LDAP: Fix enable users on successfull login\n- Update to version 9.5.13:\n  * [BUGFIX] BrowseDashboards: Only remember the most recent\n    expanded folder\n  * [BUGFIX] Licensing: Pass func to update env variables when\n    starting plugin\n- Update to version 9.5.12:\n  * [FEATURE] Azure: Add support for Workload Identity\n    authentication\n- Update to version 9.5.9:\n  * [FEATURE] SSE: Fix DSNode to not panic when response has empty\n    response\n  * [FEATURE] Prometheus: Handle the response with different field\n    key order\n  * [BUGFIX] LDAP: Fix user disabling\n\nspacecmd:\n\n- Version 5.0.5-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.0.4-0\n  * Remove rhn-profile-sync rhn_register spacewalk-channel and\n    spacewalk-update-status\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.0.3-0\n  * Remove rhnsd from client actions and server backend\n\nuyuni-tools:\n\n- Version 0.1.7-0\n  * Fix wrong Cobbler spacewalk_authentication_endpoint property after upgrade or migration\n  * Fix migration script using missing awk in migration image\n- Version 0.1.6-0\n  * Pull image from authenticated registry\n  * Port 80 should be published to the port 80 of the containers.\n    8080 is squid\n  * Autogenerate the database password\n  * Add mgrctl term command\n  * Fix --version flag\n  * Deny uyuni to suma upgrade and viceversa\n  * Refactor upgrade to clarify script end adding post upgrade\n    script (bsc#1219887)\n  * Add mgradm install podman arguments to define big volumes storage\n  * k8s migration use same functions as upgrade\n  * Allow to use images from RPM if present\n  * Schedule a system list refresh after migrate if not runned before\n  * Ignore error on optional flag\n  * Fix migration of multiple autoinstallable distributions\n  * Obsolete uyuni-proxy-systemd-service package by mgrpxy\n  * Add GitHub workflow for checking changelog\n  * Allow installation using --image image:tag\n  * Add command to register Peripheral server to Hub\n  * Add Node exporter (9100) and Taskomatic (9800) ports to the list\n    of open TCP ports\n  * Fix minimal administrator password length\n  * Do not assume the current host is a cluster node when getting\n    kubelet version\n  * Add mgrpxy start, stop and restart commands\n  * Remove shm size constraints on the server\n  * Add mgrpxy and mgradm status commands\n  * Use uninstall commands dry run by default to avoid unintended\n    removals\n  * Make first user mandatory at install time\n  * Add inspect and upgrade command\n  * Improve error handling when exec.Command is used\n  * Start/Stop/Restart command with kubernetes\n- Version 0.1.5-0\n  * Install aardvark-dns if netavark is installed (bsc#1220371)\n\n","status":"published","published":"2024-04-24T09:04:12Z","modified":"2026-02-04T02:44:55.868304Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1427-1","title":"Security Beta update for SUSE Manager Client Tools and Salt","description":"This update fixes the following issues:\n\nPOS_Image-Graphical7:\n\n- Update to version 0.1.1710765237.46af599\n  * Move image services to dracut-saltboot package\n  * Use salt bundle\n- Update to version 0.1.1645440615.7f1328c\n  * Remove deprecated kiwi functions\n\nPOS_Image-JeOS7:\n\n- Update to version 0.1.1710765237.46af599\n  * Move image services to dracut-saltboot package\n  * Use salt bundle\n- Update to version 0.1.1645440615.7f1328c\n  * Remove deprecated kiwi functions\n\nansible:\n\n- CVE-2023-5764: Address issues where internal templating can cause unsafe\n  variables to lose their unsafe designation (bsc#1216854)\n  * breaking_changes:\n    assert - Nested templating may result in an inability for the conditional\n    to be evaluated. See the porting guide for more information.\n- CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)\n- CVE-2020-14365: Do a GPG validation if the disable_gpg_check option is not set. (bsc#1175993)\n- Don't Require python-coverage, it is needed only for testing (bsc#1177948)\n- CVE-2018-10874: Inventory variables are loaded from current working directory when running ad-hoc command that can\n  lead to code execution (included upstream in 2.6.1) (bsc#1099805) \n\ndracut-saltboot:\n\n- Update to version 0.1.1710765237.46af599 \n  * Load only first available leaseinfo (bsc#1221092)\n- Update to version 0.1.1681904360.84ef141\n\n\ngrafana:\n\n- Require Go 1.20\n- Update to version 9.5.16:\n  * [SECURITY] CVE-2023-6152: Add email verification when updating\n    user email (bsc#1219912)\n  * [BUGFIX] Annotations: Split cleanup into separate queries and\n    deletes to avoid deadlocks on MySQL\n- Update to version 9.5.15:\n  * [FEATURE] Alerting: Attempt to retry retryable errors\n- Update to version 9.5.14:\n  * [BUGFIX] Alerting: Fix state manager to not keep\n    datasource_uid and ref_id labels in state after Error\n  * [BUGFIX] Transformations: Config overrides being lost when\n    config from query transform is applied\n  * [BUGFIX] LDAP: Fix enable users on successfull login\n- Update to version 9.5.13:\n  * [BUGFIX] BrowseDashboards: Only remember the most recent\n    expanded folder\n  * [BUGFIX] Licensing: Pass func to update env variables when\n    starting plugin\n- Update to version 9.5.12:\n  * [FEATURE] Azure: Add support for Workload Identity\n    authentication\n- Update to version 9.5.9:\n  * [FEATURE] SSE: Fix DSNode to not panic when response has empty\n    response\n  * [FEATURE] Prometheus: Handle the response with different field\n    key order\n  * [BUGFIX] LDAP: Fix user disabling\n\ngolang-github-prometheus-node_exporter:\n\n- Add `device_error` label for filesystem metrics.\n- Update rtnetlink library to fix errors during ARP metrics collection.\n- Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):\n  * [FEATURE] Add ZFS freebsd per dataset stats #2753\n  * [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721\n  * [ENHANCEMENT] Parallelize stat calls in Linux filesystem\n    collector #1772\n  * [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711\n  * [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric\n    #2778\n  * [ENHANCEMENT] Improve qdisc collector performance #2779\n  * [ENHANCEMENT] Add include and exclude filter for hwmon\n    collector #2699\n  * [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead\n    of procfs #2777\n  * [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754\n  * [BUGFIX] Fallback to 32-bit stats in netdev #2757\n  * [BUGFIX] Close btrfs.FS handle after use #2780\n  * [BUGFIX] Move RO status before error return #2807\n  * [BUFFIX] Fix promhttp_metric_handler_errors_total being always\n    active #2808\n  * [BUGFIX] Fix nfsd v4 index miss #2824\n- Update to 1.6.1:\n  (no source code changes in this release)\n- BuildRequire go1.20\n- Update to 1.6.0:\n  * [CHANGE] Fix cpustat when some cpus are offline #2318\n  * [CHANGE] Remove metrics of offline CPUs in CPU collector #2605\n  * [CHANGE] Deprecate ntp collector #2603\n  * [CHANGE] Remove bcache `cache_readaheads_totals` metrics #2583\n  * [CHANGE] Deprecate supervisord collector #2685\n  * [FEATURE] Enable uname collector on NetBSD #2559\n  * [FEATURE] NetBSD support for the meminfo collector #2570\n  * [FEATURE] NetBSD support for CPU collector #2626\n  * [FEATURE] Add FreeBSD collector for netisr subsystem #2668\n  * [FEATURE] Add softirqs collector #2669\n  * [ENHANCEMENT] Add suspended as a `node_zfs_zpool_state` #2449\n  * [ENHANCEMENT] Add administrative state of Linux network\n    interfaces #2515\n  * [ENHANCEMENT] Log current value of GOMAXPROCS #2537\n  * [ENHANCEMENT] Add profiler options for perf collector #2542\n  * [ENHANCEMENT] Allow root path as metrics path #2590\n  * [ENHANCEMENT] Add cpu frequency governor metrics #2569\n  * [ENHANCEMENT] Add new landing page #2622\n  * [ENHANCEMENT] Reduce privileges needed for btrfs device stats #2634\n  * [ENHANCEMENT] Add ZFS `memory_available_bytes` #2687\n  * [ENHANCEMENT] Use `SCSI_IDENT_SERIAL` as serial in diskstats #2612\n  * [ENHANCEMENT] Read missing from netlink netclass attributes from sysfs #2669\n  * [BUGFIX] perf: fixes for automatically detecting the correct\n    tracefs mountpoints #2553\n  * [BUGFIX] Fix `thermal_zone` collector noise @2554\n  * [BUGFIX] Fix a problem fetching the user wire count on FreeBSD\n    2584\n  * [BUGFIX] interrupts: Fix fields on linux aarch64 #2631\n  * [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605\n  * [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637\n  * [BUGFIX] Fix bad reporting of `node_cpu_seconds_total` in\n    OpenBSD #2663\n- Change go_modules archive in _service to use obscpio file\n\nspacecmd:\n\n- Version 5.0.5-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.0.4-0\n  * Remove rhn-profile-sync rhn_register spacewalk-channel and\n    spacewalk-update-status\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.0.3-0\n  * Remove rhnsd from client actions and server backend\n\nuyuni-tools:\n\n- Version 0.1.7-0\n  * Fix wrong Cobbler spacewalk_authentication_endpoint property after upgrade or migration\n  * Fix migration script using missing awk in migration image\n- Version 0.1.6-0\n  * Pull image from authenticated registry\n  * Port 80 should be published to the port 80 of the containers.\n    8080 is squid\n  * Autogenerate the database password\n  * Add mgrctl term command\n  * Fix --version flag\n  * Deny uyuni to suma upgrade and viceversa\n  * Refactor upgrade to clarify script end adding post upgrade\n    script (bsc#1219887)\n  * Add mgradm install podman arguments to define big volumes storage\n  * k8s migration use same functions as upgrade\n  * Allow to use images from RPM if present\n  * Schedule a system list refresh after migrate if not runned before\n  * Ignore error on optional flag\n  * Fix migration of multiple autoinstallable distributions\n  * Obsolete uyuni-proxy-systemd-service package by mgrpxy\n  * Add GitHub workflow for checking changelog\n  * Allow installation using --image image:tag\n  * Add command to register Peripheral server to Hub\n  * Add Node exporter (9100) and Taskomatic (9800) ports to the list\n    of open TCP ports\n  * Fix minimal administrator password length\n  * Do not assume the current host is a cluster node when getting\n    kubelet version\n  * Add mgrpxy start, stop and restart commands\n  * Remove shm size constraints on the server\n  * Add mgrpxy and mgradm status commands\n  * Use uninstall commands dry run by default to avoid unintended\n    removals\n  * Make first user mandatory at install time\n  * Add inspect and upgrade command\n  * Improve error handling when exec.Command is used\n  * Start/Stop/Restart command with kubernetes\n- Version 0.1.5-0\n  * Install aardvark-dns if netavark is installed (bsc#1220371)\n\n","status":"published","published":"2024-04-24T09:10:16Z","modified":"2026-02-04T02:18:06.444085Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1508-1","title":"Security update for SUSE Manager Client Tools","description":"\nThis update fixes the following issues:\n\ngolang-github-prometheus-node_exporter:\n\n- Update to 1.7.0 (jsc#PED-7893, jsc#PED-7928):\n  * [FEATURE] Add ZFS freebsd per dataset stats #2753\n  * [FEATURE] Add cpu vulnerabilities reporting from sysfs #2721\n  * [ENHANCEMENT] Parallelize stat calls in Linux filesystem\n    collector #1772\n  * [ENHANCEMENT] Add missing linkspeeds to ethtool collector #2711\n  * [ENHANCEMENT] Add CPU MHz as the value for node_cpu_info metric\n    #2778\n  * [ENHANCEMENT] Improve qdisc collector performance #2779\n  * [ENHANCEMENT] Add include and exclude filter for hwmon\n    collector #2699\n  * [ENHANCEMENT] Optionally fetch ARP stats via rtnetlink instead\n    of procfs #2777\n  * [BUFFIX] Fix ZFS arcstats on FreeBSD 14.0+ 2754\n  * [BUGFIX] Fallback to 32-bit stats in netdev #2757\n  * [BUGFIX] Close btrfs.FS handle after use #2780\n  * [BUGFIX] Move RO status before error return #2807\n  * [BUFFIX] Fix promhttp_metric_handler_errors_total being always\n    active #2808\n  * [BUGFIX] Fix nfsd v4 index miss #2824\n- Update to 1.6.1:\n  (no source code changes in this release)\n- BuildRequire go1.20\n- Update to 1.6.0:\n  * [CHANGE] Fix cpustat when some cpus are offline #2318\n  * [CHANGE] Remove metrics of offline CPUs in CPU collector #2605\n  * [CHANGE] Deprecate ntp collector #2603\n  * [CHANGE] Remove bcache `cache_readaheads_totals` metrics #2583\n  * [CHANGE] Deprecate supervisord collector #2685\n  * [FEATURE] Enable uname collector on NetBSD #2559\n  * [FEATURE] NetBSD support for the meminfo collector #2570\n  * [FEATURE] NetBSD support for CPU collector #2626\n  * [FEATURE] Add FreeBSD collector for netisr subsystem #2668\n  * [FEATURE] Add softirqs collector #2669\n  * [ENHANCEMENT] Add suspended as a `node_zfs_zpool_state` #2449\n  * [ENHANCEMENT] Add administrative state of Linux network\n    interfaces #2515\n  * [ENHANCEMENT] Log current value of GOMAXPROCS #2537\n  * [ENHANCEMENT] Add profiler options for perf collector #2542\n  * [ENHANCEMENT] Allow root path as metrics path #2590\n  * [ENHANCEMENT] Add cpu frequency governor metrics #2569\n  * [ENHANCEMENT] Add new landing page #2622\n  * [ENHANCEMENT] Reduce privileges needed for btrfs device stats\n    #2634\n  * [ENHANCEMENT] Add ZFS `memory_available_bytes` #2687\n  * [ENHANCEMENT] Use `SCSI_IDENT_SERIAL` as serial in diskstats\n    #2612\n  * [ENHANCEMENT] Read missing from netlink netclass attributes\n    from sysfs #2669\n  * [BUGFIX] perf: fixes for automatically detecting the correct\n    tracefs mountpoints #2553\n  * [BUGFIX] Fix `thermal_zone` collector noise @2554\n  * [BUGFIX] Fix a problem fetching the user wire count on FreeBSD\n    2584\n  * [BUGFIX] interrupts: Fix fields on linux aarch64 #2631\n  * [BUGFIX] Remove metrics of offline CPUs in CPU collector #2605\n  * [BUGFIX] Fix OpenBSD filesystem collector string parsing #2637\n  * [BUGFIX] Fix bad reporting of `node_cpu_seconds_total` in\n    OpenBSD #2663\n- Change go_modules archive in _service to use obscpio file\n\ngrafana:\n\n- Packaging improvements:\n  * Changed deprecated `disabled` service mode to `manual`\n  * Drop golang-packaging macros\n  * Drop explicit mod=vendor as it is enabled automatically\n- Update to version 9.5.18:\n  * [SECURITY] CVE-2024-1313: Require same organisation when\n    deleting snapshots (bsc#1222155)\n- Update to version 9.5.17:\n  * [FEATURE] Alerting: Backport use Alertmanager API v2\n- Require Go 1.20\n- Update to version 9.5.16:\n  * [SECURITY] CVE-2023-6152: Add email verification when updating\n    user email (bsc#1219912)\n  * [BUGFIX] Annotations: Split cleanup into separate queries and\n    deletes to avoid deadlocks on MySQL\n- Update to version 9.5.15:\n  * [FEATURE] Alerting: Attempt to retry retryable errors\n- Update to version 9.5.14:\n  * [BUGFIX] Alerting: Fix state manager to not keep\n    datasource_uid and ref_id labels in state after Error\n  * [BUGFIX] Transformations: Config overrides being lost when\n    config from query transform is applied\n  * [BUGFIX] LDAP: Fix enable users on successfull login\n- Update to version 9.5.13:\n  * [BUGFIX] BrowseDashboards: Only remember the most recent\n    expanded folder\n  * [BUGFIX] Licensing: Pass func to update env variables when\n    starting plugin\n- Update to version 9.5.12:\n  * [FEATURE] Azure: Add support for Workload Identity\n    authentication\n- Update to version 9.5.9:\n  * [FEATURE] SSE: Fix DSNode to not panic when response has empty\n    response\n  * [FEATURE] Prometheus: Handle the response with different field\n    key order\n  * [BUGFIX] LDAP: Fix user disabling\n\nmgr-daemon:\n\n- Version 4.3.9-0\n  * Update translation strings\n\nspacecmd:\n\n- Version 4.3.27-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 4.3.19-0\n  * Update translation strings\n\nspacewalk-koan:\n\n- Version 4.3.6-0\n  * Change Docker image location for test\n\nuyuni-common-libs:\n\n- Version 4.3.10-0\n  * Add support for package signature type V4 RSA/SHA384\n  * Add support for package signature type V4 RSA/SHA512 (bsc#1221465)\n\n","status":"published","published":"2024-05-06T09:46:36Z","modified":"2026-02-04T04:34:43.001754Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1509-1","title":"Security update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\nPOS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:\n\n- Version 0.1.1710765237.46af599\n\n  * Moved image services to dracut-saltboot package\n  * Use salt bundle\n\n- Version 0.1.1645440615.7f1328c\n\n  * Removed deprecated kiwi functions\n\nPOS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:\n\n- Version 0.1.1710765237.46af599\n\n  * Moved image services to dracut-saltboot package\n  * Use salt bundle\n\n- Version 0.1.1645440615.7f1328c\n\n  * Removed deprecated kiwi functions\n\nansible received the following fixes:\n\n- Security issues fixed:\n\n  * CVE-2023-5764: Address issues where internal templating can cause unsafe\n    variables to lose their unsafe designation (bsc#1216854)\n\n    + Breaking changes:\n      assert - Nested templating may result in an inability for the conditional\n      to be evaluated. See the porting guide for more information.\n\n  * CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)\n  * CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)\n  * CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)\n  * CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc command that\n    can lead to code execution (bsc#1099805)\n\n- Bugs fixed:  \n\n  * Don't Require python-coverage, it is needed only for testing (bsc#1177948)\n\ndracut-saltboot was updated to version 0.1.1710765237.46af599:\n\n- Version 0.1.1710765237.46af599\n\n  * Load only first available leaseinfo (bsc#1221092)\n\n- Version 0.1.1681904360.84ef141\n\ngrafana was updated to version 9.5.18:\n\n- Grafana now requires Go 1.20\n- Security issues fixed:\n\n  * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n\n- Other non-security related changes:\n\n  * Version 9.5.17:\n\n    + [FEATURE] Alerting: Backport use Alertmanager API v2\n\n  * Version 9.5.16:\n\n    + [BUGFIX] Annotations: Split cleanup into separate queries and\n      deletes to avoid deadlocks on MySQL\n\n  * Version 9.5.15:\n\n    + [FEATURE] Alerting: Attempt to retry retryable errors\n\n  * Version 9.5.14:\n\n    + [BUGFIX] Alerting: Fix state manager to not keep\n      datasource_uid and ref_id labels in state after Error\n    + [BUGFIX] Transformations: Config overrides being lost when\n      config from query transform is applied\n    + [BUGFIX] LDAP: Fix enable users on successfull login\n\n  * Version 9.5.13:\n\n    + [BUGFIX] BrowseDashboards: Only remember the most recent\n      expanded folder\n    + [BUGFIX] Licensing: Pass func to update env variables when\n      starting plugin\n\n  * Version 9.5.12:\n\n    + [FEATURE] Azure: Add support for Workload Identity\n      authentication\n\n  * Version 9.5.9:\n\n    + [FEATURE] SSE: Fix DSNode to not panic when response has empty\n      response\n    + [FEATURE] Prometheus: Handle the response with different field\n      key order\n    + [BUGFIX] LDAP: Fix user disabling\n\nmgr-daemon was updated to version 4.3.9-0:\n\n- Version 4.3.9-0\n\n  * Update translation strings\n\nspacecmd was updated to version 4.3.27-0:\n\n- Version 4.3.27-0\n\n  * Update translation strings\n\nspacewalk-client-tools was updated to version 4.3.19-0:\n\n- Version 4.3.19-0\n\n  * Update translation strings\n\nspacewalk-koan was updated to version version 4.3.6-0:\n\n- Version 4.3.6-0\n\n  * Change Docker image location for test\n\nuyuni-common-libs was updated to version 4.3.10-0:\n\n- Version 4.3.10-0\n\n  * Add support for package signature type V4 RSA/SHA384\n  * Add support for package signature type V4 RSA/SHA512 (bsc#1221465)\n\nuyuni-proxy-systemd-services was updated to version 4.3.12-0:\n\n- Version 4.3.12-0\n\n  * Update to SUSE Manager 4.3.12\n","status":"published","published":"2024-05-06T09:47:44Z","modified":"2026-02-04T03:51:25.651563Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1530-1","title":"Security update for grafana and mybatis","description":"This update for grafana and mybatis fixes the following issues:\n\ngrafana was updated to version 9.5.18:\n\n- Grafana now requires Go 1.20\n- Security issues fixed:\n\n  * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n\n- Other non-security related changes:\n\n  * Version 9.5.17:\n\n    + [FEATURE] Alerting: Backport use Alertmanager API v2\n\n  * Version 9.5.16:\n\n    + [BUGFIX] Annotations: Split cleanup into separate queries and\n      deletes to avoid deadlocks on MySQL\n\n  * Version 9.5.15:\n\n    + [FEATURE] Alerting: Attempt to retry retryable errors\n\n  * Version 9.5.14:\n\n    + [BUGFIX] Alerting: Fix state manager to not keep\n      datasource_uid and ref_id labels in state after Error\n    + [BUGFIX] Transformations: Config overrides being lost when\n      config from query transform is applied\n    + [BUGFIX] LDAP: Fix enable users on successfull login\n\n  * Version 9.5.13:\n\n    + [BUGFIX] BrowseDashboards: Only remember the most recent\n      expanded folder\n    + [BUGFIX] Licensing: Pass func to update env variables when\n      starting plugin\n\n  * Version 9.5.12:\n\n    + [FEATURE] Azure: Add support for Workload Identity\n      authentication\n\n  * Version 9.5.9:\n\n    + [FEATURE] SSE: Fix DSNode to not panic when response has empty\n      response\n    + [FEATURE] Prometheus: Handle the response with different field\n      key order\n    + [BUGFIX] LDAP: Fix user disabling\n\n\nmybatis:\n\n- `apache-commons-ognl` is now a non-optional dependency\n- Fixed building with log4j v1 and v2 dependencies\n","status":"published","published":"2024-05-06T09:52:35Z","modified":"2026-02-04T03:08:54.915132Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1530-2","title":"Security update for grafana and mybatis","description":"This update for grafana and mybatis fixes the following issues:\n\ngrafana was updated to version 9.5.18:\n\n- Grafana now requires Go 1.20\n- Security issues fixed:\n\n  * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n\n- Other non-security related changes:\n\n  * Version 9.5.17:\n\n    + [FEATURE] Alerting: Backport use Alertmanager API v2\n\n  * Version 9.5.16:\n\n    + [BUGFIX] Annotations: Split cleanup into separate queries and\n      deletes to avoid deadlocks on MySQL\n\n  * Version 9.5.15:\n\n    + [FEATURE] Alerting: Attempt to retry retryable errors\n\n  * Version 9.5.14:\n\n    + [BUGFIX] Alerting: Fix state manager to not keep\n      datasource_uid and ref_id labels in state after Error\n    + [BUGFIX] Transformations: Config overrides being lost when\n      config from query transform is applied\n    + [BUGFIX] LDAP: Fix enable users on successfull login\n\n  * Version 9.5.13:\n\n    + [BUGFIX] BrowseDashboards: Only remember the most recent\n      expanded folder\n    + [BUGFIX] Licensing: Pass func to update env variables when\n      starting plugin\n\n  * Version 9.5.12:\n\n    + [FEATURE] Azure: Add support for Workload Identity\n      authentication\n\n  * Version 9.5.9:\n\n    + [FEATURE] SSE: Fix DSNode to not panic when response has empty\n      response\n    + [FEATURE] Prometheus: Handle the response with different field\n      key order\n    + [BUGFIX] LDAP: Fix user disabling\n\n\nmybatis:\n\n- `apache-commons-ognl` is now a non-optional dependency\n- Fixed building with log4j v1 and v2 dependencies\n","status":"published","published":"2024-06-24T16:19:43Z","modified":"2026-02-04T02:28:07.756368Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2025:0524-1","title":"Security update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):\n\n- Security issues fixed:\n  * CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error\n    handling (bsc#1232970)\n\n- Highlights of other changes:\n  * Performance: \n    + Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and \n      remote write operations.\n    + Default GOGC value lowered to 75 for better memory management. \n    + Option to limit memory usage from dropped targets added.\n  * New Features:\n    + Experimental OpenTelemetry ingestion.\n    + Automatic memory limit handling.\n    + Native histogram support, including new functions, UI enhancements, and improved scraping.\n    + Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.\n    + Expanded service discovery options with added metadata and support for new services.\n    + New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.\n  * Bug Fixes: \n    + Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.\n  * For a detailed list of changes consult the package changelog or \n    https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3\n\ngolang-github-prometheus-promu was updated to version 0.17.0:\n\n- Added codesign utility function\n\ngrafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):\n\n- Security issues fixed:\n  * CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading \n    golang.org/x/crypto (bsc#1234554)\n  * CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n  * CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)\n  * CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)\n\n- Potential breaking changes in version 10:\n  * In panels using the `extract fields` transformation, where one\n    of the extracted names collides with one of the already\n    existing ields, the extracted field will be renamed.\n  * For the existing backend mode users who have table\n    visualization might see some inconsistencies on their panels.\n    We have updated the table column naming. This will\n    potentially affect field transformations and/or field\n    overrides. To resolve this either: update transformation or\n    field override.\n  * For the existing backend mode users who have Transformations\n    with the `time` field, might see their transformations are\n    not working. Those panels that have broken transformations\n    will fail to render. This is because we changed the field\n    key. To resolve this either: Remove the affected panel and\n    re-create it; Select the `Time` field again; Edit the `time`\n    field as `Time` for transformation in `panel.json` or\n    `dashboard.json` \n  * The following data source permission endpoints have been removed:\n    `GET /datasources/:datasourceId/permissions`\n    `POST /api/datasources/:datasourceId/permissions`\n    `DELETE /datasources/:datasourceId/permissions`\n    `POST /datasources/:datasourceId/enable-permissions`\n    `POST /datasources/:datasourceId/disable-permissions`\n    + Please use the following endpoints instead:\n      `GET /api/access-control/datasources/:uid` for listing data\n       source permissions\n      `POST /api/access-control/datasources/:uid/users/:id`,\n      `POST /api/access-control/datasources/:uid/teams/:id` and\n      `POST /api/access-control/datasources/:uid/buildInRoles/:id` \n      for adding or removing data source permissions\n  * If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your\n    provider.\n  * For the existing backend mode users who have table visualization might see some inconsistencies on their panels. \n    We have updated the table column naming. This will potentially affect field transformations and/or field overrides.\n  * The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed. \n    Dashboard information can be retrieved from the `/dashboard/...` APIs.\n  * The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`\n  * Removed all components for the old panel header design.\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/\n    for more details\n  * OAuth role mapping enforcement: This change impacts GitHub,\n    Gitlab, Okta, and Generic OAuth. To avoid overriding manually\n    set roles, enable the skip_org_role_sync option in the\n    Grafana configuration for your OAuth provider before\n    upgrading\n  * Angular has been deprecated\n  * Grafana legacy alerting has been deprecated\n  * API keys are migrating to service accounts\n  * The experimental \u0026#8220;dashboard previews\u0026#8221; feature is removed\n  * Usernames are now case-insensitive by default\n  * Grafana OAuth integrations do not work anymore with email lookups\n  * The \u0026#8220;Alias\u0026#8221; field in the CloudWatch data source is removed\n  * Athena data source plugin must be updated to version \u0026gt;=2.9.3\n  * Redshift data source plugin must be updated to version \u0026gt;=1.8.3\n  * DoiT International BigQuery plugin no longer supported\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0\n    for more details\n\n- This update brings many new features, enhancements and fixes highlighted at:\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/\n\nspacecmd was updated to version 5.0.11-0:\n\n- Updated translation strings\n\nsupportutils-plugin-salt was updated to version 1.2.3:\n\n- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)\n- Provide backwards-compatible scripts version\n\nsupportutils-plugin-susemanager-client was updated to version 5.0.4-0:\n\n- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)\n\nuyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:\n\n- Security issues fixed:\n  * CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)\n- Other changes and bugs fixed:\n  * Version 0.1.27-0\n    + Bump the default image tag to 5.0.3\n    + IsInstalled function fix\n    + Run systemctl daemon-reload after changing the container image config (bsc#1233279)\n    + Coco-replicas-upgrade\n    + Persist search server indexes (bsc#1231759)\n    + Sync deletes files during migration (bsc#1233660)\n    + Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)\n    + Add --registry back to mgrpxy (bsc#1233202)\n    + Only add java.hostname on migrated server if not present\n    + Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)\n    + Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)\n    + Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)\n  * Version 0.1.26-0\n    + Ignore all zypper caches during migration (bsc#1232769)\n    + Use the uyuni network for all podman containers (bsc#1232817)\n  * Version 0.1.25-0\n    + Don't migrate enabled systemd services, recreate them (bsc#1232575)\n    + Redact JSESSIONID and pxt-session-cookie values from logs and\n      console output (bsc#1231568)\n","status":"published","published":"2025-02-14T07:16:36Z","modified":"2026-02-04T04:35:03.290847Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0525-1","title":"Security update for SUSE Manager Client Tools","description":"This update fixes the following issues:\n\ndracut-saltboot was updated to version 0.1.1728559936.c16d4fb:\n\n- Added MAC based terminal naming option (jsc#SUMA-314)\n\ngolang-github-prometheus-prometheus was updated from version 2.45.6 to 2.53.3 (jsc#PED-11649):\n\n- Security issues fixed:\n  * CVE-2024-51744: Updated golang-jwt to version 5.0 to fix bad error\n    handling (bsc#1232970)\n\n- Highlights of other changes:\n  * Performance: \n    + Significant enhancements to PromQL execution speed, TSDB operations (especially querying and compaction) and \n      remote write operations.\n    + Default GOGC value lowered to 75 for better memory management. \n    + Option to limit memory usage from dropped targets added.\n  * New Features:\n    + Experimental OpenTelemetry ingestion.\n    + Automatic memory limit handling.\n    + Native histogram support, including new functions, UI enhancements, and improved scraping.\n    + Improved alerting features, such as relabeling rules for AlertmanagerConfig and a new query_offset option.\n    + Expanded service discovery options with added metadata and support for new services.\n    + New promtool commands for PromQL formatting, label manipulation, metric pushing, and OpenMetrics dumping.\n  * Bug Fixes: \n    + Numerous fixes across scraping, API, TSDB, PromQL, and service discovery.\n  * For a detailed list of changes consult the package changelog or \n    https://github.com/prometheus/prometheus/compare/v2.45.6...v2.53.3\n\ngrafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):\n\n- Security issues fixed:\n  * CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading \n    golang.org/x/crypto (bsc#1234554)\n  * CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n  * CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)\n  * CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)\n\n- Potential breaking changes in version 10:\n  * In panels using the `extract fields` transformation, where one\n    of the extracted names collides with one of the already\n    existing ields, the extracted field will be renamed.\n  * For the existing backend mode users who have table\n    visualization might see some inconsistencies on their panels.\n    We have updated the table column naming. This will\n    potentially affect field transformations and/or field\n    overrides. To resolve this either: update transformation or\n    field override.\n  * For the existing backend mode users who have Transformations\n    with the `time` field, might see their transformations are\n    not working. Those panels that have broken transformations\n    will fail to render. This is because we changed the field\n    key. To resolve this either: Remove the affected panel and\n    re-create it; Select the `Time` field again; Edit the `time`\n    field as `Time` for transformation in `panel.json` or\n    `dashboard.json` \n  * The following data source permission endpoints have been removed:\n    `GET /datasources/:datasourceId/permissions`\n    `POST /api/datasources/:datasourceId/permissions`\n    `DELETE /datasources/:datasourceId/permissions`\n    `POST /datasources/:datasourceId/enable-permissions`\n    `POST /datasources/:datasourceId/disable-permissions`\n    + Please use the following endpoints instead:\n      `GET /api/access-control/datasources/:uid` for listing data\n       source permissions\n      `POST /api/access-control/datasources/:uid/users/:id`,\n      `POST /api/access-control/datasources/:uid/teams/:id` and\n      `POST /api/access-control/datasources/:uid/buildInRoles/:id` \n      for adding or removing data source permissions\n  * If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your\n    provider.\n  * For the existing backend mode users who have table visualization might see some inconsistencies on their panels. \n    We have updated the table column naming. This will potentially affect field transformations and/or field overrides.\n  * The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed. \n    Dashboard information can be retrieved from the `/dashboard/...` APIs.\n  * The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`\n  * Removed all components for the old panel header design.\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/\n    for more details\n  * OAuth role mapping enforcement: This change impacts GitHub,\n    Gitlab, Okta, and Generic OAuth. To avoid overriding manually\n    set roles, enable the skip_org_role_sync option in the\n    Grafana configuration for your OAuth provider before\n    upgrading\n  * Angular has been deprecated\n  * Grafana legacy alerting has been deprecated\n  * API keys are migrating to service accounts\n  * The experimental “dashboard previews” feature is removed\n  * Usernames are now case-insensitive by default\n  * Grafana OAuth integrations do not work anymore with email lookups\n  * The “Alias” field in the CloudWatch data source is removed\n  * Athena data source plugin must be updated to version \u003e=2.9.3\n  * Redshift data source plugin must be updated to version \u003e=1.8.3\n  * DoiT International BigQuery plugin no longer supported\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0\n    for more details\n\n- This update brings many new features, enhancements and fixes highlighted at:\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/:\n\nspacecmd was updated to version 5.0.11-0:\n\n- Updated translation strings\n\nsupportutils-plugin-salt was updated to version 1.2.3:\n\n- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)\n- Provide backwards-compatible scripts version\n\nsupportutils-plugin-susemanager-client was updated to version 5.0.4-0:\n\n- Adjusted requirements for plugin to allow compatibility with supportutils 3.2.9 release (bsc#1235145)\n\nuyuni-tools was updated from version 0.1.23-0 to 0.1.27-0:\n\n- Security issues fixed:\n  * CVE-2024-22037: Use podman secret to store the database credentials (bsc#1231497)\n- Other changes and bugs fixed:\n  * Version 0.1.27-0\n    + Bump the default image tag to 5.0.3\n    + IsInstalled function fix\n    + Run systemctl daemon-reload after changing the container image config (bsc#1233279)\n    + Coco-replicas-upgrade\n    + Persist search server indexes (bsc#1231759)\n    + Sync deletes files during migration (bsc#1233660)\n    + Ignore coco and hub images when applying PTF if they are not ailable (bsc#1229079)\n    + Add --registry back to mgrpxy (bsc#1233202)\n    + Only add java.hostname on migrated server if not present\n    + Consider the configuration file to detect the coco or hub api images should be pulled (bsc#1229104)\n    + Only raise an error if cloudguestregistryauth fails for PAYG (bsc#1233630)\n    + Add registry.suse.com login to mgradm upgrade podman list (bsc#1234123)\n  * Version 0.1.26-0\n    + Ignore all zypper caches during migration (bsc#1232769)\n    + Use the uyuni network for all podman containers (bsc#1232817)\n  * Version 0.1.25-0\n    + Don't migrate enabled systemd services, recreate them (bsc#1232575)\n  * Version 0.1.24-0\n    + Redact JSESSIONID and pxt-session-cookie values from logs and\n      console output (bsc#1231568)\n","status":"published","published":"2025-02-14T07:18:27Z","modified":"2026-02-04T03:32:05.734623Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"SUSE-SU-2025:0545-1","title":"Security update for grafana","description":"This update for grafana fixes the following issues:\n\ngrafana was updated from version 9.5.18 to 10.4.13 (jsc#PED-11591,jsc#PED-11649):\n\n- Security issues fixed:\n  * CVE-2024-45337: Prevent possible misuse of ServerConfig.PublicKeyCallback by upgrading \n    golang.org/x/crypto (bsc#1234554)\n  * CVE-2023-3128: Fixed authentication bypass using Azure AD OAuth (bsc#1212641)\n  * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)\n  * CVE-2024-6837: Fixed potential data source permission escalation (bsc#1236301)\n  * CVE-2024-8118: Fixed permission on external alerting rule write endpoint (bsc#1231024)\n\n- Potential breaking changes in version 10:\n  * In panels using the `extract fields` transformation, where one\n    of the extracted names collides with one of the already\n    existing ields, the extracted field will be renamed.\n  * For the existing backend mode users who have table\n    visualization might see some inconsistencies on their panels.\n    We have updated the table column naming. This will\n    potentially affect field transformations and/or field\n    overrides. To resolve this either: update transformation or\n    field override.\n  * For the existing backend mode users who have Transformations\n    with the `time` field, might see their transformations are\n    not working. Those panels that have broken transformations\n    will fail to render. This is because we changed the field\n    key. To resolve this either: Remove the affected panel and\n    re-create it; Select the `Time` field again; Edit the `time`\n    field as `Time` for transformation in `panel.json` or\n    `dashboard.json` \n  * The following data source permission endpoints have been removed:\n    `GET /datasources/:datasourceId/permissions`\n    `POST /api/datasources/:datasourceId/permissions`\n    `DELETE /datasources/:datasourceId/permissions`\n    `POST /datasources/:datasourceId/enable-permissions`\n    `POST /datasources/:datasourceId/disable-permissions`\n    + Please use the following endpoints instead:\n      `GET /api/access-control/datasources/:uid` for listing data\n       source permissions\n      `POST /api/access-control/datasources/:uid/users/:id`,\n      `POST /api/access-control/datasources/:uid/teams/:id` and\n      `POST /api/access-control/datasources/:uid/buildInRoles/:id` \n      for adding or removing data source permissions\n  * If you are using Terraform Grafana provider to manage data source permissions, you will need to upgrade your\n    provider.\n  * For the existing backend mode users who have table visualization might see some inconsistencies on their panels. \n    We have updated the table column naming. This will potentially affect field transformations and/or field overrides.\n  * The deprecated `/playlists/{uid}/dashboards` API endpoint has been removed. \n    Dashboard information can be retrieved from the `/dashboard/...` APIs.\n  * The `PUT /api/folders/:uid` endpoint no more supports modifying the folder's `UID`\n  * Removed all components for the old panel header design.\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-3/\n    for more details\n  * OAuth role mapping enforcement: This change impacts GitHub,\n    Gitlab, Okta, and Generic OAuth. To avoid overriding manually\n    set roles, enable the skip_org_role_sync option in the\n    Grafana configuration for your OAuth provider before\n    upgrading\n  * Angular has been deprecated\n  * Grafana legacy alerting has been deprecated\n  * API keys are migrating to service accounts\n  * The experimental \u0026#8220;dashboard previews\u0026#8221; feature is removed\n  * Usernames are now case-insensitive by default\n  * Grafana OAuth integrations do not work anymore with email lookups\n  * The \u0026#8220;Alias\u0026#8221; field in the CloudWatch data source is removed\n  * Athena data source plugin must be updated to version \u0026gt;=2.9.3\n  * Redshift data source plugin must be updated to version \u0026gt;=1.8.3\n  * DoiT International BigQuery plugin no longer supported\n  * Please review https://grafana.com/docs/grafana/next/breaking-changes/breaking-changes-v10-0\n    for more details\n\n- This update brings many new features, enhancements and fixes highlighted at:\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-4/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-3/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-2/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-1/\n  * https://grafana.com/docs/grafana/next/whatsnew/whats-new-in-v10-0/\n","status":"published","published":"2025-02-14T07:24:15Z","modified":"2026-02-04T03:48:53.662569Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}