RHSA-2023:2784: Moderate: grafana security update
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) grafana: using email as a username can block other users from signing in (CVE-2022-39229) golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:2784?
RHSA-2023:2784 has been classified with a critical severity level due to its significant impact on security.
How do I fix RHSA-2023:2784?
To address RHSA-2023:2784, you should update to Grafana version 7.5.15-4.el8 or higher.
What software is affected by RHSA-2023:2784?
The affected software includes Grafana and Grafana-debuginfo versions below 7.5.15-4.el8.
What is the main vulnerability addressed in RHSA-2023:2784?
The primary issue fixed in RHSA-2023:2784 pertains to a reverse proxy vulnerability in Go's net/http/httputil related to unparseable query parameters.
Is there any workaround for RHSA-2023:2784 before applying the patch?
There are no recommended workarounds for RHSA-2023:2784, and it is best to apply the patch as soon as possible.