Issued:
2020-11-03
Updated:
2020-11-03

RHSA-2020:4682 - Security Advisory

Synopsis

Moderate: grafana security, bug fix, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

An update for grafana is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

The following packages have been upgraded to a later upstream version: grafana (6.7.4). (BZ#1807323)

Security Fix(es):

  • grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen (CVE-2018-18624)
  • grafana: arbitrary file read via MySQL data source (CVE-2019-19499)
  • grafana: stored XSS (CVE-2020-11110)
  • grafana: XSS annotation popup vulnerability (CVE-2020-12052)
  • grafana: XSS via column.title or cellLinkTooltip (CVE-2020-12245)
  • grafana: information disclosure through world-readable /var/lib/grafana/grafana.db (CVE-2020-12458)
  • grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)
  • grafana: XSS via the OpenTSDB datasource (CVE-2020-13430)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1807323 - Rebase of Grafana
  • BZ - 1827765 - CVE-2020-12458 grafana: information disclosure through world-readable /var/lib/grafana/grafana.db
  • BZ - 1829724 - CVE-2020-12459 grafana: information disclosure through world-readable grafana configuration files
  • BZ - 1848089 - CVE-2020-12052 grafana: XSS annotation popup vulnerability
  • BZ - 1848108 - CVE-2020-13430 grafana: XSS via the OpenTSDB datasource
  • BZ - 1848643 - CVE-2020-12245 grafana: XSS via column.title or cellLinkTooltip
  • BZ - 1850572 - CVE-2018-18624 grafana: XSS vulnerability via a column style on the "Dashboard > Table Panel" screen
  • BZ - 1861044 - CVE-2020-11110 grafana: stored XSS
  • BZ - 1873615 - CVE-2019-19499 grafana: arbitrary file read via MySQL data source

Red Hat Enterprise Linux for x86_64 8

SRPM
grafana-6.7.4-3.el8.src.rpm SHA-256: bee69087b6f5b132e0e84f05c08d1c7551142205801162094648218186422512
x86_64
grafana-6.7.4-3.el8.x86_64.rpm SHA-256: 5faeaf41fdb6d017a1bcffd5a4035821d898589c0fb67b0b6d28952c52d3bb62
grafana-azure-monitor-6.7.4-3.el8.x86_64.rpm SHA-256: ed26f1132ee25fc5e2101f7501b76f1664bb39b1e11a2c0d0c35e3ba0839aa40
grafana-cloudwatch-6.7.4-3.el8.x86_64.rpm SHA-256: 250d9d68f51591350bc77c85ab09d50b63fc0ad3194e32f49441f6fb9e638499
grafana-debuginfo-6.7.4-3.el8.x86_64.rpm SHA-256: 827dc95415d426a02e42625161670e72217f106932d1ab2b772cc222de576948
grafana-elasticsearch-6.7.4-3.el8.x86_64.rpm SHA-256: c214e11a5b574c6aaf7edc4c29a3a2af65363ef7343bed5d02dc87a734b4925f
grafana-graphite-6.7.4-3.el8.x86_64.rpm SHA-256: 59022a532338974dfe077e7cac0b6b3a669af0def7aaedf3092cd9457961af97
grafana-influxdb-6.7.4-3.el8.x86_64.rpm SHA-256: 0a45c2eb865e3975b47f73ce0500f77a20a4abea30626841ab243a3c91382f24
grafana-loki-6.7.4-3.el8.x86_64.rpm SHA-256: eb15cbfb4e1bf8f2c35ecfc327564aee42a9f17fd386cac4809f6fdfe2d598a0
grafana-mssql-6.7.4-3.el8.x86_64.rpm SHA-256: b72bcd41f993fad8f663a03d74a0d3caf8930822991fc64fdf45267a2fff08b1
grafana-mysql-6.7.4-3.el8.x86_64.rpm SHA-256: a5eb8a429b9e0da8ab1cca91a5becede547f5233c125a734f016ac7040c77f83
grafana-opentsdb-6.7.4-3.el8.x86_64.rpm SHA-256: e932c66bf11855a46a81f9046ff6205dabf6a11a1aea6b1b7c9633c125b958de
grafana-postgres-6.7.4-3.el8.x86_64.rpm SHA-256: 74b86371ff2e9560d3433094a9a975c4c2c13013cab9aed94e0a568e9c2b9f64
grafana-prometheus-6.7.4-3.el8.x86_64.rpm SHA-256: 6701cff3d90dc2a2ccf76909c3bf1fc9c000a7acb8806803dbdf71c58587c4cb
grafana-stackdriver-6.7.4-3.el8.x86_64.rpm SHA-256: e61cb6b3958343d7d3aed6b5909613538018307a4b1b574a1fafe5f7c1bbe57f

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
grafana-6.7.4-3.el8.src.rpm SHA-256: bee69087b6f5b132e0e84f05c08d1c7551142205801162094648218186422512
s390x
grafana-6.7.4-3.el8.s390x.rpm SHA-256: 7b6986673191801446201ba1cf3c6053f9b0372d6d6346277994ea4de87f8a4b
grafana-azure-monitor-6.7.4-3.el8.s390x.rpm SHA-256: 5c3bf2a0b3bad9f3bb0c7c4ebb56b75bb915a92a862b297cfb2424ea2b0a2de9
grafana-cloudwatch-6.7.4-3.el8.s390x.rpm SHA-256: d4cc8c656b547aee210ff42a8412d06980d744d3670820ada6ae63fd14bb93d1
grafana-debuginfo-6.7.4-3.el8.s390x.rpm SHA-256: 92d7fe808919cc92213dd0cd299b6c69c77e6c9fa8c5214dc0d14a61bce59d13
grafana-elasticsearch-6.7.4-3.el8.s390x.rpm SHA-256: 703624beafbd1643399378b16ca5f96459f728d6dd2560df9628cac51321a93a
grafana-graphite-6.7.4-3.el8.s390x.rpm SHA-256: e8723837ee2f4ac736d5128caf387cbfeba9ce9a352472a31c8585df9af64bf8
grafana-influxdb-6.7.4-3.el8.s390x.rpm SHA-256: 0f3ae9b416871a0ea2f740183657fc5888fd728218ac0b9a7bee49de12fd3091
grafana-loki-6.7.4-3.el8.s390x.rpm SHA-256: 66ad0b48cbacd574c5c30c7625522f4a66a215d68b8c660e301798170ec85318
grafana-mssql-6.7.4-3.el8.s390x.rpm SHA-256: c79e4b7f0320359a4e02e7af277ba6569437a1f8331dcc39b1d102720f41730b
grafana-mysql-6.7.4-3.el8.s390x.rpm SHA-256: f9967ff31cb3f8e2fab51cf536dc98cebea49527b02e15484e11adfd867a01e8
grafana-opentsdb-6.7.4-3.el8.s390x.rpm SHA-256: f15a2d439d1fe775e61ee4672730ac82f76a827072aed85afee22cd1c38a474e
grafana-postgres-6.7.4-3.el8.s390x.rpm SHA-256: 3b8cfa95d30a6c4a80025e6ddf6ed92a70d3fbbbc455d03db64bc4c4c102c853
grafana-prometheus-6.7.4-3.el8.s390x.rpm SHA-256: a8f61cf9c4454a2b2ac92cb33cd6d01e3bf21417d2fd1b880111863326c81953
grafana-stackdriver-6.7.4-3.el8.s390x.rpm SHA-256: 5e0ed9b5db2d4854e7d52e7cf2f931fe96855be9925d7ea50c503fcff4aea283

Red Hat Enterprise Linux for Power, little endian 8

SRPM
grafana-6.7.4-3.el8.src.rpm SHA-256: bee69087b6f5b132e0e84f05c08d1c7551142205801162094648218186422512
ppc64le
grafana-6.7.4-3.el8.ppc64le.rpm SHA-256: 6a4725a96394948490edb315bd3b2e8cffcda006102a3c62fadfd97d5bed07bd
grafana-azure-monitor-6.7.4-3.el8.ppc64le.rpm SHA-256: d92321a5678e3a2ff3af4b7d5167f1ff123271f70aa2d0a2513f25d8cb7f2b09
grafana-cloudwatch-6.7.4-3.el8.ppc64le.rpm SHA-256: 61d28553ab2375fa889095bfecdd857d48127f84962114061a5fe0f6ff58e541
grafana-debuginfo-6.7.4-3.el8.ppc64le.rpm SHA-256: 64974fefc28f59ad9cfd1a2baef72e5d5a828cb5119f9d53dc90a411fca5aa82
grafana-elasticsearch-6.7.4-3.el8.ppc64le.rpm SHA-256: 616512e54ec12bd39da8814024cba345c81be33c10c38dff4ed14ed09a6beba2
grafana-graphite-6.7.4-3.el8.ppc64le.rpm SHA-256: c92d26d02524e60c2b103953cd2ee0249662270fb8d23ec0e742fc8b45dd4755
grafana-influxdb-6.7.4-3.el8.ppc64le.rpm SHA-256: 3523c6fd48dcb2a5e717d9a4ca8bff16c9f93bcfed474baa5163bc0b081e2ffe
grafana-loki-6.7.4-3.el8.ppc64le.rpm SHA-256: 5efcef067d93559222e74c962dc03c1849893ac2a7fcee6c83dbeaa2e2e49c81
grafana-mssql-6.7.4-3.el8.ppc64le.rpm SHA-256: 1fe54c4a09cd4fa40f355e74ebbe535a53777b2de47c691c962bc1f3297926a5
grafana-mysql-6.7.4-3.el8.ppc64le.rpm SHA-256: a8931a9601ff7ce1361328f5cf19b73cf1ff7eff94454a0bec180b46bc04e6f6
grafana-opentsdb-6.7.4-3.el8.ppc64le.rpm SHA-256: 0590798cba2fef4499fd85164e81a0db2e481debc64bdfb30029dfb3c5872b88
grafana-postgres-6.7.4-3.el8.ppc64le.rpm SHA-256: 9a7bd45b962db11dc5d382ba03e396cfcffa35299494dcb2080c1aa54c28580c
grafana-prometheus-6.7.4-3.el8.ppc64le.rpm SHA-256: 58593552171382dc6e5cdd18421ae16aa0fe85f552b2e7845f4d07baaddefa41
grafana-stackdriver-6.7.4-3.el8.ppc64le.rpm SHA-256: bd814a866d36915ceffe29ce2d960c3e1c0f2204a48473f5b81528c8bb23bbc5

Red Hat Enterprise Linux for ARM 64 8

SRPM
grafana-6.7.4-3.el8.src.rpm SHA-256: bee69087b6f5b132e0e84f05c08d1c7551142205801162094648218186422512
aarch64
grafana-6.7.4-3.el8.aarch64.rpm SHA-256: 86fcb60efbe7a89b634ae022d90cf6b60551a840aeebf194dada06d22c16f852
grafana-azure-monitor-6.7.4-3.el8.aarch64.rpm SHA-256: 4c384f5483d6fd5dc26efe75515559f59d76aecfd1b9674bf7fb6a90cff99fa1
grafana-cloudwatch-6.7.4-3.el8.aarch64.rpm SHA-256: 7e33c79d77c65bb1563926eb479313123aa29b63a2ca48395a85d0e14699535f
grafana-debuginfo-6.7.4-3.el8.aarch64.rpm SHA-256: 4224d3265d5c5e429017956860bf780961e3ff30faa2a155bac3880f3e777a99
grafana-elasticsearch-6.7.4-3.el8.aarch64.rpm SHA-256: bb81f90c52c2da5aa1b8137ee76b9cbdeaeec1b6e733159617e1afda3a13689c
grafana-graphite-6.7.4-3.el8.aarch64.rpm SHA-256: e15bf890a1c56115409175db210c0c4c0deb61d233a2833b91f11693ac43b383
grafana-influxdb-6.7.4-3.el8.aarch64.rpm SHA-256: 5c1f0443077ae7e6264adaa4f50e3caed593fcfc598aaa0a3fb28b89557ab1c1
grafana-loki-6.7.4-3.el8.aarch64.rpm SHA-256: 3359c1b631c0c0ad2660577da0006ad320e80dd3b791838b2eb16043c8843d06
grafana-mssql-6.7.4-3.el8.aarch64.rpm SHA-256: 45ee3d6d01e8b5d453dad5d80ee0706ce073d131b7be902fe17b4366045c37a5
grafana-mysql-6.7.4-3.el8.aarch64.rpm SHA-256: a824ad3776f9997d0ab88778d7ca5c58899cc2b87c9b639789a09fa653ed258e
grafana-opentsdb-6.7.4-3.el8.aarch64.rpm SHA-256: 3a178f155bb4d4f1a5fe4c4a8c54bc343bcb2d3180eb10fdf199604db66e5b51
grafana-postgres-6.7.4-3.el8.aarch64.rpm SHA-256: 9d4dad28f70111797c2aab785285c8ce760d1ca7a5b7c183220b9fe4d45708a6
grafana-prometheus-6.7.4-3.el8.aarch64.rpm SHA-256: bbcf02bc4af9faf9fc478574956ff6222a61587aeef012afb13dc7d19b6a85a7
grafana-stackdriver-6.7.4-3.el8.aarch64.rpm SHA-256: d0bfc9cb27ec5990e3d1964b9db743731a76c3f733b75b579256b595a2c2a153

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.