RedHat: RHSA-2022-5717:01 Important: grafana security update | Linu...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: grafana security update
Advisory ID:       RHSA-2022:5717-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5717
Issue date:        2022-07-26
CVE Names:         CVE-2022-31107 
=====================================================================

1. Summary:

An update for grafana is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of
Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives
a detailed severity rating, is available for each vulnerability from the
CVE
link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

3. Description:

Grafana is an open source, feature rich metrics dashboard and graph editor
for
Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: OAuth account takeover (CVE-2022-31107)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2104367 - CVE-2022-31107 grafana: OAuth account takeover

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
grafana-7.5.11-3.el8_6.src.rpm

aarch64:
grafana-7.5.11-3.el8_6.aarch64.rpm
grafana-debuginfo-7.5.11-3.el8_6.aarch64.rpm

ppc64le:
grafana-7.5.11-3.el8_6.ppc64le.rpm
grafana-debuginfo-7.5.11-3.el8_6.ppc64le.rpm

s390x:
grafana-7.5.11-3.el8_6.s390x.rpm
grafana-debuginfo-7.5.11-3.el8_6.s390x.rpm

x86_64:
grafana-7.5.11-3.el8_6.x86_64.rpm
grafana-debuginfo-7.5.11-3.el8_6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31107
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuAeoNzjgjWX9erEAQizoQ/+ONabfmKlX0xTg/9wkoBe1tcYg9xkXCYc
4ftLJwqAjeRi+gNX1jEkisonRwvfej79t8r8RH2aSqXyAdrSLmrz9HvaArP/nUuk
Qk2aLcB1qQQm9/p5zirocUBwiG9K19DOlC6IjWWSp/qkY2WDgpAk2NhgGum5k5S4
GrA+HyThXiwy5718Z2xuaNbBRuqY/6tLDhKkJTtjNP8RtJMZQIUaZMi8HupW+CTr
HV1844EfYrxgJkJpOBBWdAgRSqcXCLTefC8nR9GfVwNdJPk1yBbas3i2j0hlQ4Bn
DU5tpmTHpusaPgs8M5H2JY6YZy/3ajvVFwpX5Psoe2PDgHAB84jC+/Kz/ApU0H0k
csUg55s4EOXgHr2gsR/vp2eqAa8tdliN8q8ymYn8hTwerYhR2qAxhoO7jlncb9B3
fZAFUzrcdid/kWNsIdsqlmyeqPPpcBHVoqvVkBa4pTMUxwMgvOKt3VEwFhYnS3jb
/vGC02XAokuxEbl4kg/tXMsoxr8OFanRs88qWjmvQ9pK/dXLICexIoLZW2aYP1Lk
ieDB2rGKV6BH053oJCUa93fvYb4RtDS+50M8BLUM49reeBPctNsX/Pn8Iwkyxryo
G2pZKxs9FwV/eqyUvRi+GlsgQXb59889T47/Q2MtfG8R36N1n8XRtfUrBA2L3k1P
04kRVtbm36s=
=T2F5
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5717:01 Important: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 8

Summary

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* grafana: OAuth account takeover (CVE-2022-31107)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-31107 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: grafana-7.5.11-3.el8_6.src.rpm
aarch64: grafana-7.5.11-3.el8_6.aarch64.rpm grafana-debuginfo-7.5.11-3.el8_6.aarch64.rpm
ppc64le: grafana-7.5.11-3.el8_6.ppc64le.rpm grafana-debuginfo-7.5.11-3.el8_6.ppc64le.rpm
s390x: grafana-7.5.11-3.el8_6.s390x.rpm grafana-debuginfo-7.5.11-3.el8_6.s390x.rpm
x86_64: grafana-7.5.11-3.el8_6.x86_64.rpm grafana-debuginfo-7.5.11-3.el8_6.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:5717-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5717
Issued Date: : 2022-07-26
CVE Names: CVE-2022-31107

Topic

An update for grafana is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactofImportant. A Common Vulnerability Scoring System (CVSS) base score, whichgivesa detailed severity rating, is available for each vulnerability from theCVElink(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2104367 - CVE-2022-31107 grafana: OAuth account takeover

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.