grafana security, bug fix, and enhancement update

7.3.6-2 - change working dir to in grafana-cli wrapper fixes Red Hat BZ 1916083 - add pcp-redis-datasource to allowloadingunsignedplugins config option 7.3.6-1 - update to 7.3.6 tagged upstream community sources, see CHANGELOG - remove dependency on SAML not supported in the open source version o...

grafana: XSS via a query alias for the Elasticsearch and Testdata datasource

A flaw was found in grafana. A XSS via a query alias for the ElasticSearch datasource is allowed...

com.alibaba.csp:sentinel-datasource-nacos (1.3.0-ga), com.alibaba.nacos:nacos-client (0.3.0) +9 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.3.0)

com.alibaba.nacos:nacos-common MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.0-ga - com.alibaba.nacos:nacos-client 0.3.0 -...

com.alibaba.csp:sentinel-datasource-nacos (1.4.1), com.alibaba.nacos:nacos-client (0.6.2) +13 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.6.2)

com.alibaba.nacos:nacos-common MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.1 - com.alibaba.nacos:nacos-client 0.6.2 -...

com.alibaba.csp:sentinel-datasource-nacos (1.4.0), com.alibaba.nacos:nacos-client (0.2.1) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.2.1)

com.alibaba.nacos:nacos-common MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.0 - com.alibaba.nacos:nacos-client 0.2.1 Source cves:...

com.alibaba.csp:sentinel-datasource-nacos (>=0.1.1, <=0.1.2), com.alibaba.csp:sentinel-demo-nacos-datasource (>=0.1.1, <=0.1.2) +6 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.1.0)

com.alibaba.nacos:nacos-common MAVEN version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos =0.1.1, =0.1.1, =3.4.7, =3.4.0, =3.7.0, =3.4.0, =3.7.0,...

com.alibaba.csp:sentinel-datasource-nacos (0.2.0), com.alibaba.csp:sentinel-demo-nacos-datasource (0.2.0) +4 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.2.0)

com.alibaba.nacos:nacos-common MAVEN version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 0.2.0 - com.alibaba.csp:sentinel-demo-nacos-datasource...

com.alibaba.csp:sentinel-datasource-nacos (1.4.1), com.alibaba.nacos:nacos-client (0.6.2) +13 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.6.2)

com.alibaba.nacos:nacos-common MAVEN version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.1 - com.alibaba.nacos:nacos-client 0.6.2 -...

com.alibaba.csp:sentinel-datasource-nacos (1.3.0-ga), com.alibaba.nacos:nacos-client (0.3.0) +9 more potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.3.0)

com.alibaba.nacos:nacos-common MAVEN version 0.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.3.0-ga - com.alibaba.nacos:nacos-client 0.3.0 -...

com.alibaba.csp:sentinel-datasource-nacos (1.4.0), com.alibaba.nacos:nacos-client (0.2.1) potentially affected by CVE-2021-29441 +1 more via com.alibaba.nacos:nacos-common (0.2.1)

com.alibaba.nacos:nacos-common MAVEN version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.alibaba.nacos:nacos-common and may be impacted: - com.alibaba.csp:sentinel-datasource-nacos 1.4.0 - com.alibaba.nacos:nacos-client 0.2.1 Source cves:...

PT-2021-3167

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.0 through 2.9.10.7 Description The issue is related to the interaction between serialization gadgets and typing, specifically involving the org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource...

UBUNTU-CVE-2020-35491

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource...

PT-2020-6950

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind versions 2.x before 2.9.10.8 Description The issue is related to the interaction between serialization gadgets and typing, which can lead to the exploitation of the vulnerability. This may allow a remote attacker to...

cloud-init security, bug fix, and enhancement update

19.4-11.0.1 - Forward port applicable cloud-init 18.4-2.0.3 changes to cloud-init-18-5 Orabug: 30435672 - Update OCI Datasource to support IMDSv2 - limit permissions Orabug: 31352433 - Changes to ignore all enslaved interfaces Orabug: 30092148 - Fix swap file size allocation logic to allocate...

grafana: information disclosure through world-readable /var/lib/grafana/grafana.db

An information-disclosure flaw was found in the way Grafana set permissions for the database directory and file. This flaw allows a local attacker access to potentially sensitive information such as cleartext or encrypted datasource passwords from /var/lib/grafana/grafana.db...

Grafana < 7.1.0-beta1 XSS Vulnerability

Grafana is vulnerable to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2020-24303

CVE-2020-24303 : Grafana before 7.1.0-beta1 is vulnerable to an XSS via a query alias for the Elasticsearch datasource. Root cause per the public description is improper input handling in the query alias pathway, enabling script execution in a victim’s browser. Exploitation status not described i...

CVE-2020-24303

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource...

CVE-2020-24303: Improper Neutralization of Input During Web Page Generation

Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource...

PT-2020-15676

Name of the Vulnerable Software and Affected Versions Grafana versions prior to 7.1.0-beta1 Description The issue allows for XSS via a query alias for the ElasticSearch datasource. There is no information provided about the estimated number of potentially affected devices worldwide or details abo...