Stay Secure with the Latest Linux Advisories

security advisorydirectory traversalmedium severity

Arch Linux: 202108-12 Medium: Loki Directory Traversal Warning

The package loki before version 2.3.0-1 is vulnerable to directory traversal. . Arch Linux Security Advisory ASA-202108-12 ========================================= Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-36156 Package : loki Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2250 Summary ====== The package loki before version 2.3.0-1 is vulnerable to directory traversal. Resolution ========= Upgrade to 2.3.0-1. # pacman -Syu "loki> =2.3.0-1" The problem has been fixed upstream in version 2.3.0. Workaround ========= None. Description ========== An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as a ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message. Impact ===== A remote attacker could disclose some of the contents of arbitrary files through a crafted X-Scope-OrgID header. References ========= https://github.com/grafana/loki/pull/4020 https://github.com/grafana/loki/commit/2fd633cded9a97c8c6b29160549a157678d1fa2f https://security.archlinux.org/CVE-2021-36156 . Ubuntu Security Notice USN-5261-1 Severity: High Date: 2021-08-11 CVE-ID: CVE-2021-36045. Arch Linux,loki package,directory traversal,security advisory,medium severity. . Severity: Medium. LinuxSecurity.com Team

Aug 13, 2021 •Medium ArchLinux