Read the docs
Red Hat Security Advisory

RHSA-2022:8057

grafana security, bug fix, and enhancement update

Released 2022-11-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 15 records

TI-2022-06078 CVE-2022-21702 · GHSA-xc3p-28hw-q24g

Cross site scripting in Grafana proxy

Priority MEDIUM 62

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.0234 Published 2022-02-08 Partial fix · 7.5.15, 8.3.5 CWE-79
TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p

Uncontrolled Resource Consumption in promhttp

Priority MEDIUM 48

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05994 Published 2022-02-15 Partial fix · 1.11.1 CWE-400
TI-2022-12771 CVE-2022-30635 · GHSA-5fhx-39r8-3jwh

Stack exhaustion when decoding certain messages in encoding/gob

Priority MEDIUM 43

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01915 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-12769 CVE-2022-30633 · GHSA-r9vw-mppf-3883

Stack exhaustion when unmarshaling certain documents in encoding/xml

Priority MEDIUM 43

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02208 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-06079 CVE-2022-21703 · GHSA-cmf4-h3xc-jw8w

Cross Site Request Forgery in Grafana

Priority MEDIUM 42

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02283 Published 2022-02-08 Partial fix · 7.5.15, 8.3.5 CWE-352
TI-2022-13881 CVE-2022-32148 · GHSA-f839-v4x8-wvr3

Exposure of client IP addresses in net/http

Priority LOW 38

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For he…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01517 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4
TI-2022-10929 CVE-2022-28131 · GHSA-3p2w-3263-9gr3

Stack exhaustion from deeply nested XML documents in encoding/xml

Priority LOW 38

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02559 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-12768 CVE-2022-30632 · GHSA-hc24-7m29-5vj7

Stack exhaustion on crafted paths in path/filepath

Priority LOW 37

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0219 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-12767 CVE-2022-30631 · GHSA-r654-8j96-crqx

Stack exhaustion when reading certain archives in compress/gzip

Priority LOW 37

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compres…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02186 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-12766 CVE-2022-30630 · GHSA-vjj7-39vr-35r3

Stack exhaustion in Glob on certain paths in io/fs

Priority LOW 37

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0219 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-01571 CVE-2022-1705 · GHSA-5hv8-7f46-fxf6

Improper sanitization of Transfer-Encoding headers in net/http

Priority LOW 32

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to re…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01531 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-444
TI-2021-06175 CVE-2021-23648 · GHSA-hqq7-2q2v-82xq

Cross-site scripting (XSS) in @braintree/sanitize-url

Priority LOW 30

The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0143 Published 2022-03-16 Partial fix · 6.0.0 CWE-79
TI-2022-01821 CVE-2022-1962 · GHSA-6mwq-4j3f-rr3x

Stack exhaustion due to deeply nested types in go/parser

Priority LOW 27

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00916 Published 2022-08-09 Partial fix · 1.17.12, 1.18.4 CWE-674
TI-2022-06050 CVE-2022-21673

OAuth Identity Token exposure in Grafana

Priority LOW 24

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01996 Published 2022-01-18 Partial fix · 7.5.13, 8.3.4 CWE-200
TI-2022-06088 CVE-2022-21713 · GHSA-63g3-9jq3-mccv

Exposure of Sensitive Information in Grafana

Priority LOW 22

Grafana is an open-source platform for monitoring and observability.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01176 Published 2022-02-08 Partial fix · 7.5.15, 8.3.5 CWE-863