Advisory ROSA-SA-2023-2299

Software: grafana 7.3.6
OS: ROSA Virtualization 2.1

package_evr_string: grafana-7.3.6-2.el8.src.rpm

CVE-ID: CVE-2020-27846
BDU-ID: None
CVE-Crit: CRITICAL
CVE-DESC.: A signature verification vulnerability exists in cookiejam/saml. This flaw allows an attacker to bypass SAML authentication. The greatest threat from this vulnerability is to the confidentiality, integrity as well as availability of the system.
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update grafana command

CVE-ID: CVE-2021-27358
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: The snapshot feature in Grafana 6.7.3-7.4.1 may allow remote attackers who have not been authenticated to initiate a denial of service via a remote API call if a frequently used configuration is set.
CVE-STATUS: Resolved
CVE-REV: To close, run the yum update grafana command