SUSE-SU-2023:2917-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2023/suse-su-20232917-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2023:2917-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2023:2917-1
Related
Published
2023-07-20T09:50:00Z
Modified
2023-07-20T09:50:00Z
Summary
Security update for SUSE Manager Client Tools
Details

This update fixes the following issues:

grafana:

  • Update to version 9.5.5:
    • CVE-2023-3128: Fix authentication bypass using Azure AD OAuth (bsc#1212641, jsc#PED-3694)
    • Bug fixes:
      • Auth: Show invite button if disable login form is set to false.
      • Azure: Fix Kusto auto-completion for Azure datasources.
      • RBAC: Remove legacy AC editor and admin role on new dashboard route.
      • API: Revert allowing editors to access GET /datasources.
      • Settings: Add ability to override skiporgrole_sync with Env variables.
  • Update to version 9.5.3:
    • CVE-2023-2801: Query: Prevent crash while executing concurrent mixed queries (bsc#1212099)
    • CVE-2023-2183: Alerting: Require alert.notifications:write permissions to test receivers and templates (bsc#1212100)
  • Update to version 9.5.2: Alerting: Scheduler use rule fingerprint instead of version. Explore: Update table min height. DataLinks: Encoded URL fixed. TimeSeries: Fix leading null-fill for missing intervals. Dashboard: Revert fixed header shown on mobile devices in the new panel header. PostgreSQL: Fix TLS certificate issue by downgrading lib/pq. Provisioning: Fix provisioning issues with legacy alerting and data source permissions. Alerting: Fix misleading status code in provisioning API. Loki: Fix log samples using instant queries. Panel Header: Implement new Panel Header on Angular Panels. Azure Monitor: Fix bug that was not showing resources for certain locations. Alerting: Fix panic when reparenting receivers to groups following an attempted rename via Provisioning. Cloudwatch Logs: Clarify Cloudwatch Logs Limits.
  • Update to 9.5.1 Loki Variable Query Editor: Fix bug when the query is updated Expressions: Fix expression load with legacy UID -100
References

Affected packages

SUSE:Linux Enterprise Module for Package Hub 15 SP4 / grafana

Package

Name
grafana
Purl
purl:rpm/suse/grafana&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.5.5-150200.3.44.1

Ecosystem specific 

{
    "binaries": [
        {
            "grafana": "9.5.5-150200.3.44.1"
        }
    ]
}

SUSE:Linux Enterprise Module for Package Hub 15 SP5 / grafana

Package

Name
grafana
Purl
purl:rpm/suse/grafana&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.5.5-150200.3.44.1

Ecosystem specific 

{
    "binaries": [
        {
            "grafana": "9.5.5-150200.3.44.1"
        }
    ]
}

openSUSE:Leap 15.4 / grafana

Package

Name
grafana
Purl
purl:rpm/suse/grafana&distro=openSUSE%20Leap%2015.4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.5.5-150200.3.44.1

Ecosystem specific 

{
    "binaries": [
        {
            "grafana": "9.5.5-150200.3.44.1"
        }
    ]
}

openSUSE:Leap 15.5 / grafana

Package

Name
grafana
Purl
purl:rpm/suse/grafana&distro=openSUSE%20Leap%2015.5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
9.5.5-150200.3.44.1

Ecosystem specific 

{
    "binaries": [
        {
            "grafana": "9.5.5-150200.3.44.1"
        }
    ]
}