Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

SUSE: 2021:1233-2 High: Kubernetes Remote Code Execution Vulnerability

suse
Calendar Grey April 15, 2021
Dist Suse Esm H88
SUSE has released a critical update for grafana and system-user-grafana, tackling significant security flaws.
An update that fixes 7 vulnerabilities is now available

Summary

This update for grafana and system-user-grafana fixes the following issues: - Updated grafana to upstream version 7.3.1 * CVE-2019-15043: In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana * CVE-2020-12245: Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip (bsc#1170557) * CVE-2020-13379: The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. This vulnerability allows any unauthenticated user/client to make Grafana send HTTP requests to any URL and return its result to the user/client. This can be used to gain information about the network that Grafana is running on. Furthermore,

Topics%20covered

Topics Covered

security advisory moderate denial of service XSS SUSE Enterprise Storage grafana SUSE Manager Tools

References

#1148383 #1170557 #1170657 #1172409 #1172450

#1175951 #1178243

Cross- CVE-2018-18623 CVE-2019-15043 CVE-2019-19499

CVE-2020-12052 CVE-2020-12245 CVE-2020-13379

CVE-2020-24303

CVSS scores:

CVE-2018-18623 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVE-2018-18623 (SUSE): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVE-2019-15043 (NVD) : 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2019-15043 (SUSE): 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

CVE-2019-19499 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE-2019-19499 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVE-2020-12052 (NVD) : 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Announcement ID: SUSE-SU-2021:1233-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate denial of service XSS SUSE Enterprise Storage grafana SUSE Manager Tools

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here