Red Hat Security AdvisoryRHSA-2018:3829
RHGS WA security and bug fix update
Released 2018-12-17 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Gluster 3.4 Web Administration Node Agent on RHEL-7 tendrl-gluster-integration-1.6.3-13.el7rhgs, tendrl-node-agent-1.6.3-11.el7rhgs
- Red Hat Gluster 3.4 Web Administration on RHEL-7 grafana-4.6.4-1.el7rhgs, tendrl-ansible-1.6.3-10.el7rhgs, tendrl-api-1.6.3-8.el7rhgs +5
Fixes 1 record
Priority HIGH 77
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.63124 · Published 2018-08-29 · Partial fix · 4.6.4, 5.2.3 CWE-287
