Red Hat Security Advisory

RHSA-2024:2568

grafana security update

Released 2024-04-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) grafana-9.2.10-16.el9_4, grafana-selinux-9.2.10-16.el9_4

Fixes 2 records

TI-2024-01301 CVE-2024-1394 · GHSA-78hx-gp6g-7mj6

Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

LOW 36

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01533 Published 2024-03-21 Partial fix · 1.4.5-1.el8ap, 1.4.5-1.el9ap +91 CWE-401

TI-2024-01223 CVE-2024-1313 · GHSA-67rv-qpw2-6qrr

Users outside an organization can delete a snapshot with its key

LOW 30

It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to /api/snapshots/<key> using its view key.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00646 Published 2024-03-26 Partial fix · 9.5.18, 10.0.13 +4 CWE-639