Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

SUSE: 2022:4428-1 Important: Grafana Security Fix for High Severity Threats

suse
Calendar Grey December 13, 2022
Scroller Suse
SUSE Security patch for prometheus addresses 10 vulnerabilities, upgrades functionalities, and bolsters system defenses.
An update that fixes 12 vulnerabilities, contains one feature is now available

Summary

This update for grafana fixes the following issues: Version update from 8.3.10 to 8.5.13 (jsc#PED-2145): - Security fixes: * CVE-2022-36062: (bsc#1203596) * CVE-2022-35957: (bsc#1203597) * CVE-2022-31107: (bsc#1201539) * CVE-2022-31097: (bsc#1201535) * CVE-2022-29170: (bsc#1199810) * CVE-2021-43813, CVE-2021-43815: (bsc#1193686) * CVE-2021-43798: (bsc#1193492) * CVE-2021-41244: (bsc#1192763) * CVE-2021-41174: (bsc#1192383) * CVE-2021-3711: (bsc#1189520) * CVE-2021-36222: (bsc#1188571) - Features and enhancements: * AccessControl: Disable user remove and user update roles when they do not have the permissions * AccessControl: Provisioning for teams * Alerting: Add custom grouping to Alert Panel * Alerting: Add safeguard for migrations that might cause dataloss

Topics%20covered

Topics Covered

security advisory high severity security fix software upgrade important SUSE Linux Enterprise grafana

References

#1188571 #1189520 #1192383 #1192763 #1193492

#1193686 #1199810 #1201535 #1201539 #1203596

#1203597 PED-2145

Cross- CVE-2021-36222 CVE-2021-3711 CVE-2021-41174

CVE-2021-41244 CVE-2021-43798 CVE-2021-43813

CVE-2021-43815 CVE-2022-29170 CVE-2022-31097

CVE-2022-31107 CVE-2022-35957 CVE-2022-36062

CVSS scores:

CVE-2021-36222 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2021-36222 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2021-3711 (NVD) : 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-3711 (SUSE): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2021-41174 (NVD) : 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

CVE-2021-41174 (SUSE): 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:4428-1
Rating: important

Topics%20covered

Topics Covered

security advisory high severity security fix software upgrade important SUSE Linux Enterprise grafana

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.