RedHat: RHSA-2022-5720:01 Important: grafana security update | Linu...

Advisories

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: grafana security update
Advisory ID:       RHSA-2022:5720-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5720
Issue date:        2022-07-26
CVE Names:         CVE-2022-31107 
=====================================================================

1. Summary:

An update for grafana is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of
Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives
a detailed severity rating, is available for each vulnerability from the
CVE
link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - aarch64, ppc64le, s390x, x86_64

3. Description:

Grafana is an open source, feature rich metrics dashboard and graph editor
for
Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: OAuth account takeover (CVE-2022-31107)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2104367 - CVE-2022-31107 grafana: OAuth account takeover

6. Package List:

Red Hat Enterprise Linux AppStream E4S (v. 8.1):

Source:
grafana-6.2.2-9.el8_1.src.rpm

aarch64:
grafana-6.2.2-9.el8_1.aarch64.rpm
grafana-azure-monitor-6.2.2-9.el8_1.aarch64.rpm
grafana-cloudwatch-6.2.2-9.el8_1.aarch64.rpm
grafana-debuginfo-6.2.2-9.el8_1.aarch64.rpm
grafana-elasticsearch-6.2.2-9.el8_1.aarch64.rpm
grafana-graphite-6.2.2-9.el8_1.aarch64.rpm
grafana-influxdb-6.2.2-9.el8_1.aarch64.rpm
grafana-loki-6.2.2-9.el8_1.aarch64.rpm
grafana-mssql-6.2.2-9.el8_1.aarch64.rpm
grafana-mysql-6.2.2-9.el8_1.aarch64.rpm
grafana-opentsdb-6.2.2-9.el8_1.aarch64.rpm
grafana-postgres-6.2.2-9.el8_1.aarch64.rpm
grafana-prometheus-6.2.2-9.el8_1.aarch64.rpm
grafana-stackdriver-6.2.2-9.el8_1.aarch64.rpm

ppc64le:
grafana-6.2.2-9.el8_1.ppc64le.rpm
grafana-azure-monitor-6.2.2-9.el8_1.ppc64le.rpm
grafana-cloudwatch-6.2.2-9.el8_1.ppc64le.rpm
grafana-debuginfo-6.2.2-9.el8_1.ppc64le.rpm
grafana-elasticsearch-6.2.2-9.el8_1.ppc64le.rpm
grafana-graphite-6.2.2-9.el8_1.ppc64le.rpm
grafana-influxdb-6.2.2-9.el8_1.ppc64le.rpm
grafana-loki-6.2.2-9.el8_1.ppc64le.rpm
grafana-mssql-6.2.2-9.el8_1.ppc64le.rpm
grafana-mysql-6.2.2-9.el8_1.ppc64le.rpm
grafana-opentsdb-6.2.2-9.el8_1.ppc64le.rpm
grafana-postgres-6.2.2-9.el8_1.ppc64le.rpm
grafana-prometheus-6.2.2-9.el8_1.ppc64le.rpm
grafana-stackdriver-6.2.2-9.el8_1.ppc64le.rpm

s390x:
grafana-6.2.2-9.el8_1.s390x.rpm
grafana-azure-monitor-6.2.2-9.el8_1.s390x.rpm
grafana-cloudwatch-6.2.2-9.el8_1.s390x.rpm
grafana-debuginfo-6.2.2-9.el8_1.s390x.rpm
grafana-elasticsearch-6.2.2-9.el8_1.s390x.rpm
grafana-graphite-6.2.2-9.el8_1.s390x.rpm
grafana-influxdb-6.2.2-9.el8_1.s390x.rpm
grafana-loki-6.2.2-9.el8_1.s390x.rpm
grafana-mssql-6.2.2-9.el8_1.s390x.rpm
grafana-mysql-6.2.2-9.el8_1.s390x.rpm
grafana-opentsdb-6.2.2-9.el8_1.s390x.rpm
grafana-postgres-6.2.2-9.el8_1.s390x.rpm
grafana-prometheus-6.2.2-9.el8_1.s390x.rpm
grafana-stackdriver-6.2.2-9.el8_1.s390x.rpm

x86_64:
grafana-6.2.2-9.el8_1.x86_64.rpm
grafana-azure-monitor-6.2.2-9.el8_1.x86_64.rpm
grafana-cloudwatch-6.2.2-9.el8_1.x86_64.rpm
grafana-debuginfo-6.2.2-9.el8_1.x86_64.rpm
grafana-elasticsearch-6.2.2-9.el8_1.x86_64.rpm
grafana-graphite-6.2.2-9.el8_1.x86_64.rpm
grafana-influxdb-6.2.2-9.el8_1.x86_64.rpm
grafana-loki-6.2.2-9.el8_1.x86_64.rpm
grafana-mssql-6.2.2-9.el8_1.x86_64.rpm
grafana-mysql-6.2.2-9.el8_1.x86_64.rpm
grafana-opentsdb-6.2.2-9.el8_1.x86_64.rpm
grafana-postgres-6.2.2-9.el8_1.x86_64.rpm
grafana-prometheus-6.2.2-9.el8_1.x86_64.rpm
grafana-stackdriver-6.2.2-9.el8_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-31107
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYuFjz9zjgjWX9erEAQjuLA//f/c648ltj+HZM+9NU0a5o98//tBrhGwl
bGKmHqVFHn9gvR0UEiSt3Ppt3RKq4TcN+6NZVlWn74L113UqlM4XZyR6LgVwcWPS
vlSottA7SuyFAMl4Ikht0n+/cUD1fuVopb5MGYzMtkzwavudbcWdDYpeRrGQW6cU
cLbpZ1h2L7n+LJMswfMXb1j8RTUVl2wcQCacg5G9el3pnxSa391ZHdrHSsUNftbD
AocssmqVCIfR8/75ul/YEthG4fg9BNng/z4lrJJjF9lmC6DSEq5pg2YbcDum1iho
5RuCnVhVXCoFCbgip273INIZroD7HSZOAd7Pa6YqW7jfgn0yg13WllvF7fZL2q/P
8YelS7wct1z4sKztEZREdeolBGefWsXuf0F6juNg72QNno0e4DQvfrHhwC6v1cB1
/jG8ybP16Y5VJcs8xujQFeip/PUaerBeBd6jGR7DYv4hmpY7cpCGpgdtgXdQ04Wr
Rg3GZ3VBJyEtLLe0ygrd+pd982VfDJnuUGp6GZ8e/+ImabbNOlez66wC03G/4fYD
/VdNW7RMFqSmIlf1GoPAmlAje5NzNay0o0NtKuo0+r/rbPy8u8GTzlrjDIIMOwbd
fOdq58IbnHlKo6j5XhdDsWCE6jf9+phPTWGV5eXUP7hEvT9UwypAi/P1avTMPei7
h9gL36BXYbw=
=xQ8p
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-5720:01 Important: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 8

Summary

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.
Security Fix(es):
* grafana: OAuth account takeover (CVE-2022-31107)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released erratarelevant to your system have been applied.For details on how to apply this update, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-31107 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream E4S (v. 8.1):
Source: grafana-6.2.2-9.el8_1.src.rpm
aarch64: grafana-6.2.2-9.el8_1.aarch64.rpm grafana-azure-monitor-6.2.2-9.el8_1.aarch64.rpm grafana-cloudwatch-6.2.2-9.el8_1.aarch64.rpm grafana-debuginfo-6.2.2-9.el8_1.aarch64.rpm grafana-elasticsearch-6.2.2-9.el8_1.aarch64.rpm grafana-graphite-6.2.2-9.el8_1.aarch64.rpm grafana-influxdb-6.2.2-9.el8_1.aarch64.rpm grafana-loki-6.2.2-9.el8_1.aarch64.rpm grafana-mssql-6.2.2-9.el8_1.aarch64.rpm grafana-mysql-6.2.2-9.el8_1.aarch64.rpm grafana-opentsdb-6.2.2-9.el8_1.aarch64.rpm grafana-postgres-6.2.2-9.el8_1.aarch64.rpm grafana-prometheus-6.2.2-9.el8_1.aarch64.rpm grafana-stackdriver-6.2.2-9.el8_1.aarch64.rpm
ppc64le: grafana-6.2.2-9.el8_1.ppc64le.rpm grafana-azure-monitor-6.2.2-9.el8_1.ppc64le.rpm grafana-cloudwatch-6.2.2-9.el8_1.ppc64le.rpm grafana-debuginfo-6.2.2-9.el8_1.ppc64le.rpm grafana-elasticsearch-6.2.2-9.el8_1.ppc64le.rpm grafana-graphite-6.2.2-9.el8_1.ppc64le.rpm grafana-influxdb-6.2.2-9.el8_1.ppc64le.rpm grafana-loki-6.2.2-9.el8_1.ppc64le.rpm grafana-mssql-6.2.2-9.el8_1.ppc64le.rpm grafana-mysql-6.2.2-9.el8_1.ppc64le.rpm grafana-opentsdb-6.2.2-9.el8_1.ppc64le.rpm grafana-postgres-6.2.2-9.el8_1.ppc64le.rpm grafana-prometheus-6.2.2-9.el8_1.ppc64le.rpm grafana-stackdriver-6.2.2-9.el8_1.ppc64le.rpm
s390x: grafana-6.2.2-9.el8_1.s390x.rpm grafana-azure-monitor-6.2.2-9.el8_1.s390x.rpm grafana-cloudwatch-6.2.2-9.el8_1.s390x.rpm grafana-debuginfo-6.2.2-9.el8_1.s390x.rpm grafana-elasticsearch-6.2.2-9.el8_1.s390x.rpm grafana-graphite-6.2.2-9.el8_1.s390x.rpm grafana-influxdb-6.2.2-9.el8_1.s390x.rpm grafana-loki-6.2.2-9.el8_1.s390x.rpm grafana-mssql-6.2.2-9.el8_1.s390x.rpm grafana-mysql-6.2.2-9.el8_1.s390x.rpm grafana-opentsdb-6.2.2-9.el8_1.s390x.rpm grafana-postgres-6.2.2-9.el8_1.s390x.rpm grafana-prometheus-6.2.2-9.el8_1.s390x.rpm grafana-stackdriver-6.2.2-9.el8_1.s390x.rpm
x86_64: grafana-6.2.2-9.el8_1.x86_64.rpm grafana-azure-monitor-6.2.2-9.el8_1.x86_64.rpm grafana-cloudwatch-6.2.2-9.el8_1.x86_64.rpm grafana-debuginfo-6.2.2-9.el8_1.x86_64.rpm grafana-elasticsearch-6.2.2-9.el8_1.x86_64.rpm grafana-graphite-6.2.2-9.el8_1.x86_64.rpm grafana-influxdb-6.2.2-9.el8_1.x86_64.rpm grafana-loki-6.2.2-9.el8_1.x86_64.rpm grafana-mssql-6.2.2-9.el8_1.x86_64.rpm grafana-mysql-6.2.2-9.el8_1.x86_64.rpm grafana-opentsdb-6.2.2-9.el8_1.x86_64.rpm grafana-postgres-6.2.2-9.el8_1.x86_64.rpm grafana-prometheus-6.2.2-9.el8_1.x86_64.rpm grafana-stackdriver-6.2.2-9.el8_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:5720-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:5720
Issued Date: : 2022-07-26
CVE Names: CVE-2022-31107

Topic

An update for grafana is now available for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactofImportant. A Common Vulnerability Scoring System (CVSS) base score, whichgivesa detailed severity rating, is available for each vulnerability from theCVElink(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream E4S (v. 8.1) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

2104367 - CVE-2022-31107 grafana: OAuth account takeover

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.