RedHat: RHSA-2022-5718:01 Important: grafana security update

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: grafana security update
Advisory ID:       RHSA-2022:5718-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5718
Issue date:        2022-07-26
CVE Names:         CVE-2022-31107 
=====================================================================

1. Summary:

An update for grafana is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of
Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives
a detailed severity rating, is available for each vulnerability from the
CVE
link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, ppc64le, s390x, x86_64

3. Description:

Grafana is an open source, feature rich metrics dashboard and graph editor
for
Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: OAuth account takeover (CVE-2022-31107)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2104367 - CVE-2022-31107 grafana: OAuth account takeover

6. Package List:

Red Hat Enterprise Linux AppStream EUS (v.8.4):

Source:
grafana-7.3.6-5.el8_4.src.rpm

aarch64:
grafana-7.3.6-5.el8_4.aarch64.rpm
grafana-debuginfo-7.3.6-5.el8_4.aarch64.rpm

ppc64le:
grafana-7.3.6-5.el8_4.ppc64le.rpm
grafana-debuginfo-7.3.6-5.el8_4.ppc64le.rpm

s390x:
grafana-7.3.6-5.el8_4.s390x.rpm
grafana-debuginfo-7.3.6-5.el8_4.s390x.rpm

x86_64:
grafana-7.3.6-5.el8_4.x86_64.rpm
grafana-debuginfo-7.3.6-5.el8_4.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31107
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuFjz9zjgjWX9erEAQiR/Q/+MvAeGRr9zpOmP6dW0prqWnHUzcIgTyfA
MdGsfAu2PACuEEGC6i8BGN/0fJmYNIkW7sAnUBKApfkIrEPNz1dyb7yN8jh3v9ld
AbaFsLs94UXUEoYVofAk/UKSv6EpPRqPN0qGNTlhOu3SImoWo7XpdMdHpvS7v7kL
3ChC2ANxXk6lyKiHKQeYi95eAxZMFv9EYW5MxJrn6U43wR7C9QFwq+oEXHbZ7VGB
DW4vLtxOvxUeLyFXLaR5bn51A/uEVdQfgcF4vzfNbde4UahTIzKr9nAK2NhU0qAl
5Qr6uiyaihgwBhhN+5khEiNAxdjhWyGWoB9xvYOjXgl2rhG+cB7zSFUd70w0BNjl
nPGDjQ8QhMm7AopA/RE8UTDlriqfwtUuzKlRTnbLOnJ3G8AWMDX5uRU1Z7D/s2nN
Q7+l7rAOBUmhFt7i9fTwr5BjTbIJCptm+C4X5y3DEOnAqJsa2vW1pSlFRiK5U5NB
udAURq+yl8yhO0Jku3PtaHc5qjx6J9Qj9/MiGr3RoFiFOK1Qmo3Lr9CneQ1t5ZyI
8age5JpSy8XsvZblF/bqm0Dz/7a+yUN/MrDgZFh5VJE5KpqV2JyzNDK5Mvdv3FtN
XBXPltOuIjy5sdSErFFyfG81i+eFMvhEogjj57JkG7nbTkReaH9FDh3eg9tfnqrY
feVwq9+bIKk=
=ZIpt
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5718:01 Important: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 8

Summary

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* grafana: OAuth account takeover (CVE-2022-31107)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-31107 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream EUS (v.8.4):
Source: grafana-7.3.6-5.el8_4.src.rpm
aarch64: grafana-7.3.6-5.el8_4.aarch64.rpm grafana-debuginfo-7.3.6-5.el8_4.aarch64.rpm
ppc64le: grafana-7.3.6-5.el8_4.ppc64le.rpm grafana-debuginfo-7.3.6-5.el8_4.ppc64le.rpm
s390x: grafana-7.3.6-5.el8_4.s390x.rpm grafana-debuginfo-7.3.6-5.el8_4.s390x.rpm
x86_64: grafana-7.3.6-5.el8_4.x86_64.rpm grafana-debuginfo-7.3.6-5.el8_4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:5718-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5718
Issued Date: : 2022-07-26
CVE Names: CVE-2022-31107

Topic

An update for grafana is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactofImportant. A Common Vulnerability Scoring System (CVSS) base score, whichgivesa detailed severity rating, is available for each vulnerability from theCVElink(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2104367 - CVE-2022-31107 grafana: OAuth account takeover

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.