OESA-2024-2260

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-2260
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2024-2260.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2024-2260
Upstream
Published
2024-10-18T11:09:23Z
Modified
2025-08-12T05:37:09.038136Z
Summary
grafana security update
Details

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where user_1 can register with one email address and user_2 can register their username as user_1’s email address. This prevents user_1 logging into the application since user_1's password won’t match with user_2's email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.(CVE-2022-39229)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:22.03-LTS-SP1 / grafana

Package

Name
grafana
Purl
pkg:rpm/openEuler/grafana&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.5.15-7.oe2203sp1

Ecosystem specific 

{
    "aarch64": [
        "grafana-7.5.15-7.oe2203sp1.aarch64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2203sp1.aarch64.rpm"
    ],
    "x86_64": [
        "grafana-7.5.15-7.oe2203sp1.x86_64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2203sp1.x86_64.rpm"
    ],
    "src": [
        "grafana-7.5.15-7.oe2203sp1.src.rpm"
    ]
}

openEuler:24.03-LTS / grafana

Package

Name
grafana
Purl
pkg:rpm/openEuler/grafana&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.5.15-7.oe2403

Ecosystem specific 

{
    "aarch64": [
        "grafana-7.5.15-7.oe2403.aarch64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2403.aarch64.rpm"
    ],
    "x86_64": [
        "grafana-7.5.15-7.oe2403.x86_64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2403.x86_64.rpm"
    ],
    "src": [
        "grafana-7.5.15-7.oe2403.src.rpm"
    ]
}

openEuler:22.03-LTS-SP4 / grafana

Package

Name
grafana
Purl
pkg:rpm/openEuler/grafana&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.5.15-7.oe2203sp4

Ecosystem specific 

{
    "aarch64": [
        "grafana-7.5.15-7.oe2203sp4.aarch64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "grafana-7.5.15-7.oe2203sp4.x86_64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2203sp4.x86_64.rpm"
    ],
    "src": [
        "grafana-7.5.15-7.oe2203sp4.src.rpm"
    ]
}

openEuler:22.03-LTS-SP3 / grafana

Package

Name
grafana
Purl
pkg:rpm/openEuler/grafana&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.5.15-7.oe2203sp3

Ecosystem specific 

{
    "aarch64": [
        "grafana-7.5.15-7.oe2203sp3.aarch64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2203sp3.aarch64.rpm"
    ],
    "x86_64": [
        "grafana-7.5.15-7.oe2203sp3.x86_64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2203sp3.x86_64.rpm"
    ],
    "src": [
        "grafana-7.5.15-7.oe2203sp3.src.rpm"
    ]
}

openEuler:20.03-LTS-SP4 / grafana

Package

Name
grafana
Purl
pkg:rpm/openEuler/grafana&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.5.15-7.oe2003sp4

Ecosystem specific 

{
    "aarch64": [
        "grafana-7.5.15-7.oe2003sp4.aarch64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "grafana-7.5.15-7.oe2003sp4.x86_64.rpm",
        "grafana-debuginfo-7.5.15-7.oe2003sp4.x86_64.rpm"
    ],
    "src": [
        "grafana-7.5.15-7.oe2003sp4.src.rpm"
    ]
}