grafana security, bug fix, and enhancement update

7.3.6-2 - change working dir to in grafana-cli wrapper fixes Red Hat BZ 1916083 - add pcp-redis-datasource to allowloadingunsignedplugins config option 7.3.6-1 - update to 7.3.6 tagged upstream community sources, see CHANGELOG - remove dependency on SAML not supported in the open source version o...

grafana: XSS via a query alias for the Elasticsearch and Testdata datasource

A flaw was found in grafana. A XSS via a query alias for the ElasticSearch datasource is allowed...

PT-2021-3167

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.0 through 2.9.10.7 Description The issue is related to the interaction between serialization gadgets and typing, specifically involving the org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource...

UBUNTU-CVE-2020-35491

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource...

PT-2020-6950

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8 Description The issue is related to the interaction between serialization gadgets and typing, which can lead to the exploitation of the vulnerability. This may allow a remote attacker to...

cloud-init security, bug fix, and enhancement update

19.4-11.0.1 - Forward port applicable cloud-init 18.4-2.0.3 changes to cloud-init-18-5 Orabug: 30435672 - Update OCI Datasource to support IMDSv2 - limit permissions Orabug: 31352433 - Changes to ignore all enslaved interfaces Orabug: 30092148 - Fix swap file size allocation logic to allocate...

grafana: information disclosure through world-readable /var/lib/grafana/grafana.db

An information-disclosure flaw was found in the way Grafana set permissions for the database directory and file. This flaw allows a local attacker access to potentially sensitive information such as cleartext or encrypted datasource passwords from /var/lib/grafana/grafana.db...

Grafana < 7.1.0-beta1 XSS Vulnerability

Grafana is vulnerable to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2020-24303

CVE-2020-24303 : Grafana before 7.1.0-beta1 is vulnerable to an XSS via a query alias for the Elasticsearch datasource. Root cause per the public description is improper input handling in the query alias pathway, enabling script execution in a victim’s browser. Exploitation status not described i...

CVE-2020-24303

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource...

CVE-2020-24303: Improper Neutralization of Input During Web Page Generation

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource...

PT-2020-15676

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.1.0-beta1 Description The issue allows for XSS via a query alias for the ElasticSearch datasource. There is no information provided about the estimated number of potentially affected devices worldwide or details abo...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

CVE-2020-13430

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...

PT-2020-13536

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.0.0 Description The issue allows tag value XSS via the OpenTSDB datasource. This can be exploited in Grafana, potentially affecting devices that use the OpenTSDB datasource. No information is provided about the...

CVE-2020-13430: Improper Neutralization of Input During Web Page Generation

Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...

jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource

A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the HikariDataSource gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping or when @JsonTypeInfo is using Id.CLASS or...

CVE-2020-12458: Incorrect Permission Assignment for Critical Resource

An information-disclosure flaw was found in Grafana through 6.7.3. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can result in exposure of sensitive information e.g., cleartext or encrypted datasource passwords...

PT-2020-13123

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.2.1 Grafana versions through 6.7.3 Description An information-disclosure flaw was found in Grafana. The database directory /var/lib/grafana and database file /var/lib/grafana/grafana.db are world readable. This can...

Ignite Realtime Openfire Cross-Site Scripting Vulnerability (CNVD-2020-18551)

Ignite Realtime Openfire is a real-time collaboration RTC server licensed under the open source Apache license. A cross-site scripting vulnerability exists in Ignite Realtime Openfire 4.4.1. An attacker can exploit this vulnerability to conduct a cross-site scripting attack via the...