Vulnerability from csaf_suse
Published
2020-05-13 14:23
Modified
2020-05-13 14:23
Summary
Security update for grafana

Notes

Title of the patch
Security update for grafana
Description of the patch
This update for grafana to version 4.6.5 fixes the following issues: Security issues fixed: - CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383). - CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960). - CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515). - CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985). - CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862). Non-security issue fixed: - Solve wrongly categorized 'default.ini' file. (bsc#1167424) The configuration file was wrongly classified as documentation instead of configuration file. In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.
Patchnames
SUSE-2020-1273,SUSE-Storage-5-2020-1273
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for grafana",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for grafana to version 4.6.5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-15043: Added authentication to a few rest endpoints (jsc#SOC-10357, bsc#1148383).\n- CVE-2018-19039: Fixed File Exfiltration vulnerability (jsc#SOC-9976 bsc#1115960).\n- CVE-2018-15727: Fixed an LDAP and OAuth login vulnerability (jsc#SOC-9980 bsc#1106515).\n- CVE-2018-12099: Fixed cross site scripting vulnerabilities in dashboard links (bsc#1096985).\n- CVE-2019-13068: Fixed an HTML injection in the panel drilldown links (bsc#1139862).\n\nNon-security issue fixed:\n\n- Solve wrongly categorized 'default.ini' file. (bsc#1167424)\n  The configuration file was wrongly classified as documentation instead of configuration file.\n  In systems where the documentation isn't installed by default was not possible to start the 'grafana server' service.\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2020-1273,SUSE-Storage-5-2020-1273",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_1273-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2020:1273-1",
            url: "https://www.suse.com/support/update/announcement/2020/suse-su-20201273-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2020:1273-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2020-May/006815.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1096985",
            url: "https://bugzilla.suse.com/1096985",
         },
         {
            category: "self",
            summary: "SUSE Bug 1106515",
            url: "https://bugzilla.suse.com/1106515",
         },
         {
            category: "self",
            summary: "SUSE Bug 1115960",
            url: "https://bugzilla.suse.com/1115960",
         },
         {
            category: "self",
            summary: "SUSE Bug 1139862",
            url: "https://bugzilla.suse.com/1139862",
         },
         {
            category: "self",
            summary: "SUSE Bug 1148383",
            url: "https://bugzilla.suse.com/1148383",
         },
         {
            category: "self",
            summary: "SUSE Bug 1167424",
            url: "https://bugzilla.suse.com/1167424",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-12099 page",
            url: "https://www.suse.com/security/cve/CVE-2018-12099/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-15727 page",
            url: "https://www.suse.com/security/cve/CVE-2018-15727/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-19039 page",
            url: "https://www.suse.com/security/cve/CVE-2018-19039/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-558213 page",
            url: "https://www.suse.com/security/cve/CVE-2018-558213/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-13068 page",
            url: "https://www.suse.com/security/cve/CVE-2019-13068/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-15043 page",
            url: "https://www.suse.com/security/cve/CVE-2019-15043/",
         },
      ],
      title: "Security update for grafana",
      tracking: {
         current_release_date: "2020-05-13T14:23:49Z",
         generator: {
            date: "2020-05-13T14:23:49Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2020:1273-1",
         initial_release_date: "2020-05-13T14:23:49Z",
         revision_history: [
            {
               date: "2020-05-13T14:23:49Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "grafana-4.6.5-3.10.1.aarch64",
                        product: {
                           name: "grafana-4.6.5-3.10.1.aarch64",
                           product_id: "grafana-4.6.5-3.10.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "grafana-4.6.5-3.10.1.x86_64",
                        product: {
                           name: "grafana-4.6.5-3.10.1.x86_64",
                           product_id: "grafana-4.6.5-3.10.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Enterprise Storage 5",
                        product: {
                           name: "SUSE Enterprise Storage 5",
                           product_id: "SUSE Enterprise Storage 5",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:ses:5",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "grafana-4.6.5-3.10.1.aarch64 as component of SUSE Enterprise Storage 5",
               product_id: "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
            },
            product_reference: "grafana-4.6.5-3.10.1.aarch64",
            relates_to_product_reference: "SUSE Enterprise Storage 5",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "grafana-4.6.5-3.10.1.x86_64 as component of SUSE Enterprise Storage 5",
               product_id: "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
            },
            product_reference: "grafana-4.6.5-3.10.1.x86_64",
            relates_to_product_reference: "SUSE Enterprise Storage 5",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2018-12099",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-12099",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-12099",
               url: "https://www.suse.com/security/cve/CVE-2018-12099",
            },
            {
               category: "external",
               summary: "SUSE Bug 1096985 for CVE-2018-12099",
               url: "https://bugzilla.suse.com/1096985",
            },
            {
               category: "external",
               summary: "SUSE Bug 1172450 for CVE-2018-12099",
               url: "https://bugzilla.suse.com/1172450",
            },
            {
               category: "external",
               summary: "SUSE Bug 1174583 for CVE-2018-12099",
               url: "https://bugzilla.suse.com/1174583",
            },
            {
               category: "external",
               summary: "SUSE Bug 1175951 for CVE-2018-12099",
               url: "https://bugzilla.suse.com/1175951",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-05-13T14:23:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-12099",
      },
      {
         cve: "CVE-2018-15727",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-15727",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid \"remember me\" cookie knowing only a username of an LDAP or OAuth user.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-15727",
               url: "https://www.suse.com/security/cve/CVE-2018-15727",
            },
            {
               category: "external",
               summary: "SUSE Bug 1106515 for CVE-2018-15727",
               url: "https://bugzilla.suse.com/1106515",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.2,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-05-13T14:23:49Z",
               details: "important",
            },
         ],
         title: "CVE-2018-15727",
      },
      {
         cve: "CVE-2018-19039",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-19039",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-19039",
               url: "https://www.suse.com/security/cve/CVE-2018-19039",
            },
            {
               category: "external",
               summary: "SUSE Bug 1115960 for CVE-2018-19039",
               url: "https://bugzilla.suse.com/1115960",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-05-13T14:23:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-19039",
      },
      {
         cve: "CVE-2018-558213",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-558213",
            },
         ],
         notes: [
            {
               category: "general",
               text: "** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-15727. Reason: This candidate is a reservation duplicate of CVE-2018-15727. Notes: All CVE users should reference CVE-2018-15727 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-558213",
               url: "https://www.suse.com/security/cve/CVE-2018-558213",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-05-13T14:23:49Z",
               details: "low",
            },
         ],
         title: "CVE-2018-558213",
      },
      {
         cve: "CVE-2019-13068",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-13068",
            },
         ],
         notes: [
            {
               category: "general",
               text: "public/app/features/panel/panel_ctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-13068",
               url: "https://www.suse.com/security/cve/CVE-2019-13068",
            },
            {
               category: "external",
               summary: "SUSE Bug 1139862 for CVE-2019-13068",
               url: "https://bugzilla.suse.com/1139862",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
                  version: "3.0",
               },
               products: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-05-13T14:23:49Z",
               details: "moderate",
            },
         ],
         title: "CVE-2019-13068",
      },
      {
         cve: "CVE-2019-15043",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-15043",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
               "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-15043",
               url: "https://www.suse.com/security/cve/CVE-2019-15043",
            },
            {
               category: "external",
               summary: "SUSE Bug 1148383 for CVE-2019-15043",
               url: "https://bugzilla.suse.com/1148383",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.aarch64",
                  "SUSE Enterprise Storage 5:grafana-4.6.5-3.10.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-05-13T14:23:49Z",
               details: "important",
            },
         ],
         title: "CVE-2019-15043",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.