[ASA-202108-12] loki: directory traversal

Arch Linux Security Advisory ASA-202108-12 ========================================== Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-36156 Package : loki Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2250 Summary ======= The package loki before version...

CVE-2021-36156

Grafana Loki (≤ 2.2.1) is affected by CVE-2021-36156: crafting the X-Scope-OrgID header can cause directory traversal when Loki builds file paths to rules files, potentially causing the service to parse and leak parts of arbitrary files in error messages. Public advisories (Arch Linux ASA-202108-...