SUSE-SU-2023:0821-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:0821-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2023:0821-1
- Related
- Published
- 2023-03-20T15:35:12Z
- Modified
- 2023-03-20T15:35:12Z
- Summary
- Security update for grafana
- Details
-
This update for grafana fixes the following issues:
- CVE-2022-23552: Fixed SVG processing by adding a dompurify preprocessor step (bsc#1207749).
- CVE-2022-39324: Fixed originalUrl spoof security issue (bsc#1207750).
- CVE-2022-41723: Fixed go issue to avoid quadratic complexity in HPACK decoding (bsc#1208293).
- CVE-2022-46146: Fixed basic authentication bypass by updating the exporter toolkit (bsc#1208065).
- Trim leading and trailing whitespaces from email and username on signup
- Fix invitation validation: Check whether the provided email address is the same as where the invitation is sent
- References
-
- https://www.suse.com/support/update/announcement/2023/suse-su-20230821-1/
- https://bugzilla.suse.com/1207749
- https://bugzilla.suse.com/1207750
- https://bugzilla.suse.com/1208065
- https://bugzilla.suse.com/1208293
- https://www.suse.com/security/cve/CVE-2022-23552
- https://www.suse.com/security/cve/CVE-2022-39324
- https://www.suse.com/security/cve/CVE-2022-41723
- https://www.suse.com/security/cve/CVE-2022-46146
Affected packages
SUSE:Linux Enterprise Module for Package Hub 15 SP4 / grafana
Package
- Name
- grafana
- Purl
- purl:rpm/suse/grafana&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4