Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 506
Alerts This Week
Warning Icon 1 506

openSUSE: 2023:2917-1 Critical: Grafana Authentication Bypass

opensuse
Calendar Grey July 20, 2023
Scroller Opensuse
A vital security patch for SUSE Manager Client Tools resolves challenges within Grafana, encompassing enhancements in authentication and various bug resolutions.
This update fixes the following issues: grafana:

Description

This update fixes the following issues:

grafana:

* Update to version 9.5.5:

* CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641,

jsc#PED-3694)

* Bug fixes:

* Auth: Show invite button if disable login form is set to false.

* Azure: Fix Kusto auto-completion for Azure datasources.

* RBAC: Remove legacy AC editor and admin role on new dashboard route.

* API: Revert allowing editors to access GET /datasources.

* Settings: Add ability to override skip_org_role_sync with Env variables.

* Update to version 9.5.3:

* CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries

(bsc#1212099)

* CVE-2023-2183: Alerting: Require alert.notifications:write permissions to

test receivers and templates (bsc#1212100)

* Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of

version. Explore: Update table min height. DataLinks: Encoded URL fixed.

TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert

...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory update critical authentication issue fix suse manager grafana

Patch

## Patch Instructions:

To install this SUSE Critical update use the SUSE recommended installation

methods like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* openSUSE Leap 15.4

zypper in -t patch openSUSE-SLE-15.4-2023-2917=1

* openSUSE Leap 15.5

zypper in -t patch openSUSE-SLE-15.5-2023-2917=1

* SUSE Package Hub 15 15-SP4

zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP4-2023-2917=1

* SUSE Package Hub 15 15-SP5

zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2023-2917=1

Package List

* openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)

* grafana-debuginfo-9.5.5-150200.3.44.1

* grafana-9.5.5-150200.3.44.1

* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

* grafana-debuginfo-9.5.5-150200.3.44.1

* grafana-9.5.5-150200.3.44.1

* SUSE Package Hub 15 15-SP4 (aarch64 ppc64le s390x x86_64)

* grafana-debuginfo-9.5.5-150200.3.44.1

* grafana-9.5.5-150200.3.44.1

* SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64)

* grafana-debuginfo-9.5.5-150200.3.44.1

* grafana-9.5.5-150200.3.44.1

References

* #1212099

* #1212100

* #1212641

## References:

* https://www.suse.com/security/cve/CVE-2023-2183.html

* https://www.suse.com/security/cve/CVE-2023-2801.html

* https://www.suse.com/security/cve/CVE-2023-3128.html

* https://bugzilla.suse.com/show_bug.cgi?id=1212099

* https://bugzilla.suse.com/show_bug.cgi?id=1212100

* https://bugzilla.suse.com/show_bug.cgi?id=1212641

*

*

Severity
critical
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2023:2917-1
Rating: critical

Topics%20covered

Topics Covered

security advisory update critical authentication issue fix suse manager grafana

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.