An information-disclosure flaw was found in the way Grafana set permissions for the database directory and file. This flaw allows a local attacker access to potentially sensitive information such as cleartext or encrypted datasource passwords from /var/lib/grafana/grafana.db.

Mitigation

Manually change the directory and files permissions to remove readable bits for others:

chmod 750 /var/lib/grafana

chmod 640 /var/lib/grafana/grafana.db

chown grafana:grafana /var/lib/grafana/grafana.db