Red Hat Security AdvisoryRHSA-2023:2167
grafana security and enhancement update
Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) grafana-9.0.9-2.el9
Fixes 5 records
Priority LOW 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03487 · Published 2022-09-06 · Partial fix · 0.0.0-20220906165146-f3363e06e74c
Priority LOW 36
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01726 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2
Priority LOW 36
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01408 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2 CWE-444
Priority LOW 35
Grafana is an open-source platform for monitoring and observability.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.01633 · Published 2022-09-20 · Partial fix · 8.5.13, 9.1.6 +1 CWE-290
Priority LOW 22
Grafana is an open source data visualization platform for metrics, logs, and traces.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01143 · Published 2022-10-13 · Partial fix · 9.1.8, 8.5.14 CWE-287
THREATIST.IORead the docs